CVE-2026-100261: Medium severity JetBrains YouTrack vulnerability
Published Sep 30, 2026
·Updated
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
Affected Software
1 affected component
JetBrains YouTrack<2026.2.18991
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetBrains YouTrackto a version that resolves this vulnerability.Fixed in 2026.2.18991
Event History
Sep 30, 2026
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs network access to the YouTrack instance and existing low-privileged access. No user interaction is required.
2
What actions could an unauthorized user take?
A user without update permission could change article visibility settings. The supplied severity vector indicates potential low-impact confidentiality and integrity effects.
3
Which deployments are affected?
JetBrains YouTrack versions before 2026.2.18991 are affected. The provided information does not identify any configuration prerequisites or exclusions.