CVE-2026-123323: High severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

Event History

Nov 6, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

JetBrains YouTrack deployments running versions earlier than 2025.3.170763, 2026.1.14150, or 2026.2.19656 are affected.

What access does an attacker need to exploit this issue?

The vector is network-based with low attack complexity, but exploitation requires high privileges and user interaction. The issue involves an app widget host allowing apps to send REST requests without user confirmation.

What is the security impact of successful exploitation?

The vulnerability is rated high severity with a CVSS score of 8.4. It can affect confidentiality, integrity, and availability at a high level, and its scope can extend beyond the vulnerable component.

CVE-2026-123323: High severity vulnerability

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the security impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the security impact of successful exploitation?