CVE-2026-123328Medium· 6.4▾ SunlitIn JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
YouTrack < 2026.2.19656Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123324High· 7.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
CVE-2026-123326High· 7.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
CVE-2026-123333Low· 3.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
CVE-2026-123334Low· 3.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
CVE-2026-103488High· 7.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
CVE-2026-100277High· 8.9In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature