AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JetBrainsCVE-2026-86489

JetBrains YouTrack: insecure direct object reference

JetBrains

CVE-2026-86489 · Published Sep 7, 2026 · updated Sep 8, 2026

Medium6.5
Fix: upgrade to 2026.2.18634 or later
JetBrains advisory

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

Affected versions

PackageAffectedFixed in
YouTrack
Product
< 2026.2.186342026.2.18634
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-639

More JetBrains advisories

All JetBrains
Low 3.3Sep 7JetBrains IntelliJ IDEA: information disclosureCVE-2026-86505fixed in 2026.2.2Medium 5.9Sep 7JetBrains GoLand: missing authenticationCVE-2026-86506fixed in 2026.2.2.1Medium 6.8Sep 7JetBrains YouTrack: information disclosureCVE-2026-86497fixed in 2026.2.18769High 7.7Sep 7JetBrains YouTrack: improper authorizationCVE-2026-86498fixed in 2025.3.160480 +1Medium 4.3Sep 7JetBrains YouTrack: missing authorizationCVE-2026-86499fixed in 2026.1.14047Medium 5.5Sep 7In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user...CVE-2026-86500fixed in 2026.1.14047