CVE-2026-75045

CriticalCVSS 9.1/10Last modified Sep 15, 2026

Description

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
JetBrains	YouTrack	< 2025.3.156085, 2026.1.13913, 2026.2.18112

References

https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Timeline

Published: Aug 17, 2026
Last modified: Sep 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-750464.3In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint CVE-2026-750476.5In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint CVE-2026-750488.2In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible CVE-2026-750496.5In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the dr CVE-2026-75057.3A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler.CVE-2026-750506.5In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters CVE-2026-750518.1In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible CVE-2026-750524.4In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects CVE-2026-750535.4In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint CVE-2026-750546.3In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects CVE-2026-750555.5In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE CVE-2026-750567.8In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible