CVE-2026-103491

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1034926.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsCVE-2026-1034938.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleCVE-2026-1034946.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changesCVE-2026-1034954.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsCVE-2026-1034965.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notificationsCVE-2026-1034975.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationCVE-2026-1034997.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow CVE-2026-10353.1A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing reCVE-2026-1035006.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulneraCVE-2026-1035019.8Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in CVE-2026-1035025.9Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pmCVE-2026-1035035.9Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate f
CVE-2026-103491: Medium severity, CVSS 6.5 | Vulnix