{"id":"CVE-2026-123335","kind":"vulnerability","aliases":["CVE-2026-123335"],"related":[],"title":"JetBrains YouTrack: missing authorization lets users attach tags to any issue","description":"In JetBrains YouTrack before 2026.2.19562, \n2026.1.14137, \n2025.3.169041 missing authorization  allowed attaching tags to any issue via the tag issues collection","summary":"JetBrains YouTrack did not check permissions when adding tags through the tag issues collection, so a user could attach tags to any issue. An attacker could change how issues are labelled and filtered, but the sources do not describe access to issue content.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","other","self-hosted","youtrack"],"not_affected_if":["already-patched"],"how_to_check":"- Check the installed YouTrack version against `2026.2.19562`, `2026.1.14137` and `2025.3.169041`.\n- Versions below the fixed build on your release line are affected.","fix":"- Upgrade YouTrack to `2026.2.19562` on the 2026.2 line.\n- Upgrade YouTrack to `2026.1.14137` on the 2026.1 line.\n- Upgrade YouTrack to `2025.3.169041` on the 2025.3 line.","status":"open","published_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","triaged_at":"2026-11-06T11:42:50+00:00","updated_at":"2026-11-06T11:42:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YouTrack to `2026.2.19562` on the 2026.2 line.\n- Upgrade YouTrack to `2026.1.14137` on the 2026.1 line.\n- Upgrade YouTrack to `2025.3.169041` on the 2025.3 line.","reach":"network","title":"JetBrains YouTrack: missing authorization lets users attach tags to any issue","impact":"low","summary":"JetBrains YouTrack did not check permissions when adding tags through the tag issues collection, so a user could attach tags to any issue. An attacker could change how issues are labelled and filtered, but the sources do not describe access to issue content.","audience":"businesses","category":"other","nicknames":[],"who_cares":["youtrack","jetbrains","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Any issue can be tagged by a user lacking permission.","analyst_note":"","how_to_check":"- Check the installed YouTrack version against `2026.2.19562`, `2026.1.14137` and `2025.3.169041`.\n- Versions below the fixed build on your release line are affected.","plain_action":"","needs_analyst":false,"not_affected_if":["already-patched"],"who_is_affected":"Teams that run self-hosted or cloud YouTrack on an affected release can have issues tagged by users who should not be able to. The sources do not say whether the flaw needs a logged-in account, so check your user base. Installations already on the listed fixed builds or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.001083,"input_tokens":4207,"output_tokens":1324,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123335':14A,17A '-2026':13A,16A '2025.3.169041':73C '2026.1.14137':72C '2026.2.19562':71C 'access':63B 'add':31B 'allow':76C 'attach':7A,42B,77C 'attack':48B 'author':4A,75C 'chang':50B 'check':28B 'collect':37B,86C 'content':66B 'could':41B,49B 'cve':12A,15A 'describ':62B 'filter':56B 'host':22B 'issu':11A,36B,46B,52B,65B,81C,85C 'jetbrain':1A,18B,24B,68C 'label':54B 'let':5A 'miss':3A,74C 'permiss':29B 'self':21B 'self-host':20B 'sourc':59B 'tag':8A,32B,35B,43B,78C,84C 'user':6A,40B 'via':82C 'youtrack':2A,23B,25B,69C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted or cloud YouTrack on an affected release can have issues tagged by users who should not be able to. The sources do not say whether the flaw needs a logged-in account, so check your user base. Installations already on the listed fixed builds or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","low","other","selfhosted","youtrack"],"campaign_type":null,"search_a":"'-123335':14A,17A '-2026':13A,16A 'attach':7A 'author':4A 'cve':12A,15A 'issu':11A 'jetbrain':1A 'let':5A 'miss':3A 'tag':8A 'user':6A 'youtrack':2A","search_b":"'access':63B 'add':31B 'attach':42B 'attack':48B 'chang':50B 'check':28B 'collect':37B 'content':66B 'could':41B,49B 'describ':62B 'filter':56B 'host':22B 'issu':36B,46B,52B,65B 'jetbrain':18B,24B 'label':54B 'permiss':29B 'self':21B 'self-host':20B 'sourc':59B 'tag':32B,35B,43B 'user':40B 'youtrack':23B,25B","search_c":"'2025.3.169041':73C '2026.1.14137':72C '2026.2.19562':71C 'allow':76C 'attach':77C 'author':75C 'collect':86C 'issu':81C,85C 'jetbrain':68C 'miss':74C 'tag':78C,84C 'via':82C 'youtrack':69C","first_public_at":"2026-11-06T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123335","severity":null,"published_at":"2026-11-06T11:17:13+00:00","modified_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","fetched_at":"2026-11-06T11:41:28+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}