YouTrack vulnerabilities
CVEs whose affected-version data names the YouTrack package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
63 CVEsRSS
CVE-2026-75045Critical· 9.1PoCIn JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
▾ Abyssaljetbrains · youtrackEPSS 0.47%via NVD
CVE-2026-75044High· 8.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
▾ Twilightjetbrains · youtrackEPSS 0.42%via NVD
CVE-2026-75051High· 8.1In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
▾ Twilightjetbrains · youtrackEPSS 0.39%via NVD