CVE-2026-75044

HighCVSS 8.1/10Last modified Sep 15, 2026

Description

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2026
Last modified: Sep 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-750459.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via sha CVE-2026-750464.3In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint CVE-2026-750476.5In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint CVE-2026-750488.2In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible CVE-2026-750496.5In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the dr CVE-2026-75057.3A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler.CVE-2026-750506.5In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters CVE-2026-750518.1In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible CVE-2026-750524.4In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects CVE-2026-750535.4In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint CVE-2026-750546.3In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects CVE-2026-750555.5In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE