PatchTheCVECVE-2026-75049: In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles
29
Routine
MEDIUM 6.5UPGRADE
CVE-2026-75049 is a medium-severity flaw (CVSS 6.5) affecting youtrack. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-08-17 |
| Last modified | 2026-10-23 |
Publisher (CNA): JetBrains s.r.o. · Vendor: jetbrains
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
jetbrains youtrack UPGRADE
Affected: < 2026.1.13903 · >= 2026.2 and < 2026.2.17950
Fixed in: 2026.1.13903, 2026.2.17950
Safe to downgrade to: a release before 2026.2
1. Check installed version
apt-cache policy youtrack || rpm -q youtrack || youtrack --version
2. UPGRADE to 2026.1.13903 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade youtrack
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade youtrack
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026.2 (Debian / Ubuntu)
apt-cache madison youtrack
sudo apt install youtrack=<VERSION_BEFORE_2026.2>
sudo apt-mark hold youtrack
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list youtrack
sudo dnf downgrade youtrack-<VERSION_BEFORE_2026.2>
sudo dnf versionlock add youtrack
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-75050 HIGH 7.1 UPGRADE In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
- CVE-2026-75048 HIGH 8.2 UPGRADE In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
- CVE-2026-75051 HIGH 8.1 UPGRADE In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible