PatchTheCVEyoutrack vulnerabilities and fixes
Recent CVEs affecting youtrack, with upgrade or downgrade steps. 4 tracked.
youtrack has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-17. Highest priority: CVE-2026-75050 (score 41/100).
- CVE-2026-75050 HIGH 7.1 UPGRADE In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
- CVE-2026-75048 HIGH 8.2 UPGRADE In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
- CVE-2026-75051 HIGH 8.1 UPGRADE In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
- CVE-2026-75049 MEDIUM 6.5 UPGRADE In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles
FAQ
How do I fix youtrack vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is youtrack being exploited right now?
None of the tracked youtrack CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which youtrack CVE should I patch first?
CVE-2026-75050 currently ranks highest (41/100): In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters.