CVE-2026-100268: High severity JetBrains YouTrack vulnerability
Published Sep 30, 2026
·Updated
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
Affected Software
1 affected component
JetBrains YouTrack<2026.2.19197
Event History
Sep 30, 2026
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs project administrator privileges in JetBrains YouTrack. The issue allows such an administrator to read comments belonging to other projects through notification templates.
2
What versions are affected?
JetBrains YouTrack versions before 2026.2.19197 are affected. Upgrading to 2026.2.19197 or later addresses the affected version range.
3
Is this exposed to unauthenticated users?
No. Exploitation requires low-level authenticated privileges, specifically project administrator access; no user interaction is required.