CVE-2026-86499: Medium severity JetBrains YouTrack vulnerability
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated YouTrack user can exploit it, including users without permission to view the affected groups. No user interaction is required.
What information can be exposed?
The issue exposes the names of all groups through predefined search fields. The provided data does not indicate exposure of group membership or other group details.
Which deployments are affected?
JetBrains YouTrack versions before 2026.1.14047 are affected. Because the issue occurs regardless of group visibility permission, deployments relying on restricted group visibility are exposed to unauthorized group-name disclosure.
What should administrators do?
Upgrade YouTrack to version 2026.1.14047 or later. If upgrading cannot happen immediately, treat group names as potentially visible to all authenticated users and avoid using sensitive information in group names where possible.