CVE-2026-123324

HighCVSS 7.7/10Last modified Nov 6, 2026

Description

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233257.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandCVE-2026-1233267.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionCVE-2026-1233277.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptionsCVE-2026-1233286.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tabCVE-2026-1233295.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actionsCVE-2026-1233305.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settingsCVE-2026-1233315.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articlesCVE-2026-1233324.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurationsCVE-2026-1233333.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprintsCVE-2026-1233343.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another projectCVE-2026-1233353.5In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the CVE-2026-1233363.1In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
CVE-2026-123324: High severity, CVSS 7.7 | Vulnix