CVE-2026-103496

MediumCVSS 5.4/10Last modified Oct 1, 2026

Description

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1034975.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationCVE-2026-1034997.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow CVE-2026-10353.1A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing reCVE-2026-1035006.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulneraCVE-2026-1035019.8Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in CVE-2026-1035025.9Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pmCVE-2026-1035035.9Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate fCVE-2026-1035048.1Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and CVE-2026-1035056.5Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3CVE-2026-1035077.5Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding tCVE-2026-1035087.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafCVE-2026-1035098.5P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privile
CVE-2026-103496: Medium severity, CVSS 5.4 | Vulnix