CVE-2026-123335 · Other
NO FIX YET · SEE WHAT TO DO
JetBrains YouTrack did not check permissions when adding tags through the tag issues collection, so a user could attach tags to any issue. An attacker could change how issues are labelled and filtered, but the sources do not describe access to issue content.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run self-hosted or cloud YouTrack on an affected release can have issues tagged by users who should not be able to. The sources do not say whether the flaw needs a logged-in account, so check your user base. Installations already on the listed fixed builds or later are not affected.
Not affected if already-patched
Who cares jetbrains, self-hosted, youtrack
2026.2.19562, 2026.1.14137 and 2025.3.169041.2026.2.19562 on the 2026.2 line.2026.1.14137 on the 2026.1 line.2025.3.169041 on the 2025.3 line.In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.