{"id":"CVE-2026-123329","kind":"vulnerability","aliases":["CVE-2026-123329"],"related":[],"title":"JetBrains YouTrack: TeamCity integration leaks other projects' actions","description":"In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions","summary":"JetBrains YouTrack before 2026.2.19562 has a missing authorization check in its TeamCity integration. An attacker can read actions belonging to other projects.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","other","self-hosted","teamcity","youtrack"],"not_affected_if":["youtrack-2026.2.19562-or-later"],"how_to_check":"- Check the YouTrack version, for example in the admin panel or with the server's about page.\n- Check whether the TeamCity integration is enabled in YouTrack.","fix":"- Move YouTrack to `2026.2.19562` or later.","status":"open","published_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:42:30+00:00","updated_at":"2026-11-06T11:42:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move YouTrack to `2026.2.19562` or later.","reach":"unknown","title":"JetBrains YouTrack: TeamCity integration leaks other projects' actions","impact":"low","summary":"JetBrains YouTrack before 2026.2.19562 has a missing authorization check in its TeamCity integration. An attacker can read actions belonging to other projects.","audience":"businesses","category":"other","nicknames":[],"who_cares":["youtrack","teamcity","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads other projects' actions through the integration","analyst_note":"","how_to_check":"- Check the YouTrack version, for example in the admin panel or with the server's about page.\n- Check whether the TeamCity integration is enabled in YouTrack.","plain_action":"","needs_analyst":false,"not_affected_if":["youtrack-2026.2.19562-or-later"],"who_is_affected":"Teams that self-host or run JetBrains YouTrack before 2026.2.19562 and use its TeamCity integration. Installs without the TeamCity integration are likely not exposed, but the sources do not confirm this. The sources do not say what access an attacker needs.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":4180,"output_tokens":481,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123329':11A,14A '-2026':10A,13A '2026.2.19562':25B,48C 'action':8A,39B,59C 'allow':54C 'attack':36B 'author':29B,50C 'belong':40B 'check':30B 'cve':9A,12A 'disclosur':55C 'host':19B 'integr':4A,34B,53C 'jetbrain':1A,15B,22B,45C 'leak':5A 'miss':28B,49C 'project':7A,43B,58C 'read':38B 'self':18B 'self-host':17B 'teamciti':3A,20B,33B,52C 'youtrack':2A,21B,23B,46C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run JetBrains YouTrack before 2026.2.19562 and use its TeamCity integration. Installs without the TeamCity integration are likely not exposed, but the sources do not confirm this. The sources do not say what access an attacker needs.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","other","selfhosted","teamcity","youtrack"],"campaign_type":null,"search_a":"'-123329':11A,14A '-2026':10A,13A 'action':8A 'cve':9A,12A 'integr':4A 'jetbrain':1A 'leak':5A 'project':7A 'teamciti':3A 'youtrack':2A","search_b":"'2026.2.19562':25B 'action':39B 'attack':36B 'author':29B 'belong':40B 'check':30B 'host':19B 'integr':34B 'jetbrain':15B,22B 'miss':28B 'project':43B 'read':38B 'self':18B 'self-host':17B 'teamciti':20B,33B 'youtrack':21B,23B","search_c":"'2026.2.19562':48C 'action':59C 'allow':54C 'author':50C 'disclosur':55C 'integr':53C 'jetbrain':45C 'miss':49C 'project':58C 'teamciti':52C 'youtrack':46C","first_public_at":"2026-11-06T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123329","severity":null,"published_at":"2026-11-06T11:17:13+00:00","modified_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}