CVE-2026-100272: Medium severity JetBrains YouTrack vulnerability
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetBrains YouTrackto a version that resolves this vulnerability.Fixed in 2026.2.19197
Event History
Frequently Asked Questions
Who can exploit this issue?
A Project Administrator can exploit the missing authorization check in the notification template preview. The attack can be performed remotely and does not require user interaction.
What information could be exposed?
The issue allows a Project Administrator to read restricted issues through the notification template preview. The reported impact is limited to confidentiality; integrity and availability are not affected.
Which YouTrack versions are affected?
JetBrains YouTrack versions before 2026.2.19197 are affected. Upgrading to version 2026.2.19197 or later addresses the affected version range.