CVE-2026-123335

LowCVSS 3.5/10Last modified Nov 6, 2026

Description

In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	YouTrack	< 2026.2.19562, 2026.1.14137, 2025.3.169041

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233363.1In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion CVE-2026-1233373.1In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility CVE-2026-123338Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can CVE-2026-1233392.3Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to CVE-2026-1233415.4Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convin CVE-2026-1233567.5GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTrain CVE-2026-1233570.0GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion CVE-2026-1233642.4OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a cr CVE-2026-1233677.4Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate CVE-2026-1233682.3compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, co CVE-2026-1233695.3compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lin CVE-2026-1233705.1compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, com