---
id: "CVE-2026-123324"
page: "https://infrastack.ai/live/CVE-2026-123324"
kind: "vulnerability"
aliases: ["CVE-2026-123324"]
title: "JetBrains YouTrack: shared mailbox message history leaks information to users"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jetbrains", "package", "self-hosted", "youtrack"]
not_affected_if: ["version-2026.2.19562-or-later"]
published_at: "2026-11-06T11:17:12+00:00"
first_seen_at: "2026-11-06T11:41:27+00:00"
updated_at: "2026-11-06T11:42:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123324", "first_seen_at": "2026-11-06T11:41:27+00:00"}]
exploit_sources: []
---

# JetBrains YouTrack: shared mailbox message history leaks information to users

Link for people: https://infrastack.ai/live/CVE-2026-123324 (this .md is for agents)

Before version 2026.2.19562, JetBrains YouTrack exposed information through the message history of shared mailboxes. The sources do not say exactly what data is disclosed or to whom.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YouTrack version in the admin panel or the server's build info; the sources do not say where it is shown.

## Fix

- Move to YouTrack `2026.2.19562` or later.

## Timeline

- 2026-11-06T11:41:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123324

## From the sources

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_