CVE-2026-86489: Medium severity JetBrains YouTrack vulnerability
Published Sep 7, 2026
·Updated
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
Affected Software
1 affected component
JetBrains YouTrack<2026.2.18634
Event History
Sep 7, 2026
CVE Published
via MITRE·04:26 PM
Data Sourced
via MITRE·04:26 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which YouTrack instances should be considered affected?
JetBrains YouTrack versions before 2026.2.18634 are affected. Instances running 2026.2.18634 or later are not identified as affected by the provided information.
2
Does exploitation require an authenticated account?
Yes. The vulnerability has a privileges-required rating of low, indicating an attacker needs an account with some level of access. The attack can be conducted over the network and does not require user interaction.