CVE-2026-111092: Medium severity JetBrains YouTrack vulnerability
Published Oct 15, 2026
·Updated
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
Affected Software
1 affected component
JetBrains YouTrack<2026.2.19575, <2026.3.16075, <2026.3.16397, <2026.3.16402
Event History
Oct 15, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires a project administrator. The issue involves mail rules that allow that administrator to execute issue commands across project boundaries.
2
What is the potential impact?
A project administrator could run commands against issues in other projects, potentially affecting the confidentiality and integrity of those projects' issue data. The provided CVSS vector does not indicate an availability impact.
3
Which YouTrack versions need attention?
The issue affects JetBrains YouTrack versions before 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402. Update to an applicable listed fixed version or later.