CVE-2026-86478 – JetBrains YouTrack
“When the gatekeeper forgets to check badges, every visitor can walk off with the keys to the project.”
JetBrains YouTrack updates fix ten authorization and authentication flaws that let attackers take over accounts, gain higher privileges, and change or reach data they should never touch. The most serious is CVE-2026-86478, which has a CVSS score of 9.8, Critical severity. A flaw in YouTrack Helpdesk let an unauthenticated attacker take over an account by claiming an email address. CVE-2026-100277 has a CVSS score of 8.9, High severity, and allowed account takeover by replaying a notification signature. CVE-2026-100273 has a CVSS score of 8.2, High severity, and let an attacker bypass authorization in the scripts debugger to run arbitrary code.
The remaining flaws widen access and privileges. CVE-2026-86482 has a CVSS score of 8.8, High severity, and CVE-2026-103490 has a CVSS score of 7.2, High severity; both allow privilege escalation, through role assignments and user group links. CVE-2026-86479 has a CVSS score of 8.0, High severity, and exposes restricted REST API resources. CVE-2026-103488 has a CVSS score of 7.1, High severity, and lets users join project teams to read restricted issues. CVE-2026-86494 and CVE-2026-86498 each have a CVSS score of 7.7, High severity, and allow unauthorized changes to links on issues and linked entities. CVE-2026-100262 has a CVSS score of 7.6, High severity, and lets read-only users overwrite project notification templates. Upgrade YouTrack to 2026.2.19422 or later to close all ten flaws.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-290