CVE-2026-123325

HighCVSS 7.1/10Last modified Nov 7, 2026

Description

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-829

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsYouTrack< 2025.3.170763, 2026.1.14150, 2026.2.19656

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233267.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionCVE-2026-1233277.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptionsCVE-2026-1233286.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tabCVE-2026-1233295.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actionsCVE-2026-1233305.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settingsCVE-2026-1233315.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articlesCVE-2026-1233324.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurationsCVE-2026-1233333.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprintsCVE-2026-1233343.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another projectCVE-2026-1233353.5In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the CVE-2026-1233363.1In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversionCVE-2026-1233373.1In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility