CVE-2026-86487: Low severity JetBrains YouTrack vulnerability
Published Sep 7, 2026
·Updated
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
Affected Software
1 affected component
JetBrains YouTrack<2026.2.18634
Event History
Sep 7, 2026
CVE Published
via MITRE·04:26 PM
Data Sourced
via MITRE·04:26 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs a read-only whiteboard user account and the ability to send a crafted WebSocket message. The issue affects whiteboard access controls rather than unauthenticated users.
2
What is the impact of successful exploitation?
A read-only whiteboard user can modify canvas content. The provided information indicates an integrity impact only; it does not indicate confidentiality or availability impact.
3
Which YouTrack versions are affected?
JetBrains YouTrack versions before 2026.2.18634 are affected. Upgrading to 2026.2.18634 or later addresses the affected version range.