CVE-2026-123323High· 8.4▾ TwilightIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
YouTrack < 2025.3.170763, 2026.1.14150, 2026.2.19656Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123327High· 7.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
CVE-2026-123330Medium· 5.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
CVE-2026-123331Medium· 5.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
CVE-2026-123332Medium· 4.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
CVE-2026-123335Low· 3.5In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
CVE-2026-123337Low· 3.1In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility