{"id":"CVE-2026-123331","kind":"vulnerability","aliases":["CVE-2026-123331"],"related":[],"title":"JetBrains YouTrack: article editors could change visibility of restricted child articles","description":"In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles","summary":"In JetBrains YouTrack before 2026.2.19197, users with article edit rights could change the visibility of child articles they were not supposed to control. The sources do not say what the exposed content is or whether it can be read by people who should not see it.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","other","self-hosted","youtrack"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed YouTrack version in the administration panel; affected if it is below `2026.2.19197`","fix":"- JetBrains YouTrack: upgrade to `2026.2.19197` or later","status":"open","published_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","triaged_at":"2026-11-06T11:42:27+00:00","updated_at":"2026-11-06T11:42:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:27Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains YouTrack: upgrade to `2026.2.19197` or later","reach":"network","title":"JetBrains YouTrack: article editors could change visibility of restricted child articles","impact":"medium","summary":"In JetBrains YouTrack before 2026.2.19197, users with article edit rights could change the visibility of child articles they were not supposed to control. The sources do not say what the exposed content is or whether it can be read by people who should not see it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["youtrack","jetbrains","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Article editors can expose restricted child articles to wider audiences.","analyst_note":"","how_to_check":"- Check the installed YouTrack version in the administration panel; affected if it is below `2026.2.19197`\n- unknown for anything beyond the version check; the sources do not say which article settings to review","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Self-hosted or cloud YouTrack instances before 2026.2.19197 that use knowledge base articles with restricted child articles. The sources do not say which configurations are needed beyond that; teams on a later version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4160,"output_tokens":488,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123331':14A,17A '-2026':13A,16A '2026.2.19197':28B,73C 'articl':3A,11A,31B,40B,74C,82C 'chang':6A,35B,77C 'child':10A,39B,81C 'content':55B 'control':46B 'could':5A,34B,76C 'cve':12A,15A 'edit':32B 'editor':4A,75C 'expos':54B 'host':22B 'jetbrain':1A,18B,25B,70C 'peopl':64B 'read':62B 'restrict':9A,80C 'right':33B 'say':51B 'see':68B 'self':21B 'self-host':20B 'sourc':48B 'suppos':44B 'user':29B 'visibl':7A,37B,78C 'whether':58B 'youtrack':2A,23B,26B,71C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud YouTrack instances before 2026.2.19197 that use knowledge base articles with restricted child articles. The sources do not say which configurations are needed beyond that; teams on a later version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","other","selfhosted","youtrack"],"campaign_type":null,"search_a":"'-123331':14A,17A '-2026':13A,16A 'articl':3A,11A 'chang':6A 'child':10A 'could':5A 'cve':12A,15A 'editor':4A 'jetbrain':1A 'restrict':9A 'visibl':7A 'youtrack':2A","search_b":"'2026.2.19197':28B 'articl':31B,40B 'chang':35B 'child':39B 'content':55B 'control':46B 'could':34B 'edit':32B 'expos':54B 'host':22B 'jetbrain':18B,25B 'peopl':64B 'read':62B 'right':33B 'say':51B 'see':68B 'self':21B 'self-host':20B 'sourc':48B 'suppos':44B 'user':29B 'visibl':37B 'whether':58B 'youtrack':23B,26B","search_c":"'2026.2.19197':73C 'articl':74C,82C 'chang':77C 'child':81C 'could':76C 'editor':75C 'jetbrain':70C 'restrict':80C 'visibl':78C 'youtrack':71C","first_public_at":"2026-11-06T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123331","severity":null,"published_at":"2026-11-06T11:17:13+00:00","modified_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","fetched_at":"2026-11-06T11:41:28+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}