CVE-2026-123328 · Vendor
NO FIX YET · SEE WHAT TO DO
In JetBrains YouTrack before 2026.2.19656, an app permission check could be bypassed through the project tab, letting a user gain higher privileges. An attacker who already has a YouTrack account can use this to act beyond their granted rights.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted YouTrack installations before 2026.2.19656 are affected, since the flaw is in the app permission handling of the project tab. The sources do not say whether JetBrains Cloud-hosted YouTrack instances are affected. Teams already on 2026.2.19656 or later can skip it.
Not affected if already-patched
Who cares jetbrains, self-hosted, youtrack
2026.2.196562026.2.19656In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.