CVE-2026-123329 · Other
NO FIX YET · SEE WHAT TO DO
JetBrains YouTrack before 2026.2.19562 has a missing authorization check in its TeamCity integration. An attacker can read actions belonging to other projects.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host or run JetBrains YouTrack before 2026.2.19562 and use its TeamCity integration. Installs without the TeamCity integration are likely not exposed, but the sources do not confirm this. The sources do not say what access an attacker needs.
Not affected if youtrack-2026.2.19562-or-later
Who cares jetbrains, self-hosted, teamcity, youtrack
2026.2.19562 or later.In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.