{"id":"CVE-2026-123323","kind":"vulnerability","aliases":["CVE-2026-123323"],"related":[],"title":"JetBrains YouTrack: app widget host lets apps send REST requests unconfirmed","description":"In JetBrains YouTrack before 2025.3.170763, \n2026.1.14150, \n2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation","summary":"JetBrains YouTrack before 2025.3.170763, 2026.1.14150 and 2026.2.19656 fails to validate URLs in its app widget host. A malicious or compromised app widget can send REST requests to YouTrack without asking the user to confirm, so it can act with the user's privileges.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","runtime","self-hosted","youtrack"],"not_affected_if":["no-app-widgets","patched-version"],"how_to_check":"- Check the installed YouTrack version in the About page or the server admin panel and compare it with the fixed versions `2025.3.170763`, `2026.1.14150`, `2026.2.19656`.\n- Review which app widgets or apps are installed in YouTrack.","fix":"- JetBrains YouTrack: move to `2025.3.170763`, `2026.1.14150` or `2026.2.19656` (the fixed version on your release line).","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:41:48+00:00","updated_at":"2026-11-06T11:41:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T11:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains YouTrack: move to `2025.3.170763`, `2026.1.14150` or `2026.2.19656` (the fixed version on your release line).","reach":"network","title":"JetBrains YouTrack: app widget host lets apps send REST requests unconfirmed","impact":"high","summary":"JetBrains YouTrack before 2025.3.170763, 2026.1.14150 and 2026.2.19656 fails to validate URLs in its app widget host. A malicious or compromised app widget can send REST requests to YouTrack without asking the user to confirm, so it can act with the user's privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["youtrack","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Installed app widgets act on the user's behalf against YouTrack data","analyst_note":"Confirm the exact attack prerequisites (installed app or widget, user session) from the JetBrains advisory; the NVD text does not say.","how_to_check":"- Check the installed YouTrack version in the About page or the server admin panel and compare it with the fixed versions `2025.3.170763`, `2026.1.14150`, `2026.2.19656`.\n- Review which app widgets or apps are installed in YouTrack.","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","no-app-widgets"],"who_is_affected":"Teams that self-host JetBrains YouTrack on a version earlier than the fixed releases and use app widgets or apps inside it. The sources do not describe a hosted-only exposure, so treat self-hosted and any unpatched instance as affected. Instances on the fixed versions, or without app widgets installed, are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4208,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123323':14A,17A '-2026':13A,16A '2025.3.170763':27B,71C '2026.1.14150':28B,72C '2026.2.19656':30B,73C 'act':61B 'allow':82C 'app':3A,7A,37B,44B,79C,83C 'ask':53B 'compromis':43B 'confirm':57B,90C 'cve':12A,15A 'fail':31B 'host':5A,22B,39B,81C 'improp':74C 'jetbrain':1A,18B,24B,68C 'let':6A 'malici':41B 'privileg':66B 'request':10A,49B,87C 'rest':9A,48B,86C 'runtim':19B 'self':21B 'self-host':20B 'send':8A,47B,85C 'unconfirm':11A 'url':34B,75C 'user':55B,64B,89C 'valid':33B,76C 'widget':4A,38B,45B,80C 'without':52B,88C 'youtrack':2A,23B,25B,51B,69C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host JetBrains YouTrack on a version earlier than the fixed releases and use app widgets or apps inside it. The sources do not describe a hosted-only exposure, so treat self-hosted and any unpatched instance as affected. Instances on the fixed versions, or without app widgets installed, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jetbrains","runtime","selfhosted","youtrack"],"campaign_type":null,"search_a":"'-123323':14A,17A '-2026':13A,16A 'app':3A,7A 'cve':12A,15A 'host':5A 'jetbrain':1A 'let':6A 'request':10A 'rest':9A 'send':8A 'unconfirm':11A 'widget':4A 'youtrack':2A","search_b":"'2025.3.170763':27B '2026.1.14150':28B '2026.2.19656':30B 'act':61B 'app':37B,44B 'ask':53B 'compromis':43B 'confirm':57B 'fail':31B 'host':22B,39B 'jetbrain':18B,24B 'malici':41B 'privileg':66B 'request':49B 'rest':48B 'runtim':19B 'self':21B 'self-host':20B 'send':47B 'url':34B 'user':55B,64B 'valid':33B 'widget':38B,45B 'without':52B 'youtrack':23B,25B,51B","search_c":"'2025.3.170763':71C '2026.1.14150':72C '2026.2.19656':73C 'allow':82C 'app':79C,83C 'confirm':90C 'host':81C 'improp':74C 'jetbrain':68C 'request':87C 'rest':86C 'send':85C 'url':75C 'user':89C 'valid':76C 'widget':80C 'without':88C 'youtrack':69C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123323","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}