CVE-2026-123323 · Runtime
NO FIX YET · SEE WHAT TO DO
JetBrains YouTrack before 2025.3.170763, 2026.1.14150 and 2026.2.19656 fails to validate URLs in its app widget host. A malicious or compromised app widget can send REST requests to YouTrack without asking the user to confirm, so it can act with the user's privileges.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host JetBrains YouTrack on a version earlier than the fixed releases and use app widgets or apps inside it. The sources do not describe a hosted-only exposure, so treat self-hosted and any unpatched instance as affected. Instances on the fixed versions, or without app widgets installed, are less exposed.
Not affected if no-app-widgets, patched-version
Who cares jetbrains, self-hosted, youtrack
2025.3.170763, 2026.1.14150, 2026.2.19656.2025.3.170763, 2026.1.14150 or 2026.2.19656 (the fixed version on your release line).In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.