SB2025111101 - Multiple vulnerabilities in JetBrains YouTrack
Published: November 11, 2025 Updated: November 11, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2025-64686)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to a missing user principal cleanup. A remote user can gain access to the application within an incorrect authorization context.
2) Improper Certificate Validation (CVE-ID: CVE-2025-64685)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper certificate validation. A remote attacker can perform MitM attack and gain access to sensitive information.
3) Missing Authorization (CVE-ID: CVE-2025-64684)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing authorization checks within the the feedback form. A remote attacker can gain access to sensitive information.
4) Missing Authorization (CVE-ID: CVE-2025-64690)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to missing authorization checks. A remote authenticated user can gain access to sensitive information and perform unauthorized changes.
5) Insufficiently protected credentials (CVE-ID: CVE-2025-64689)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect configuration in the Junie could. A remote attacker can gain unauthorized access to the global Junie token and compromise the repository.
6) Authorization bypass through user-controlled key (CVE-ID: CVE-2025-64688)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to missing access restrictions. A remote authenticated user can manipulate the VCS URL and manage repositories from the Junie widget.
7) Missing Authorization (CVE-ID: CVE-2025-64687)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to alter application behavior.
the vulnerability exists due to missing authoreization checks. A remote user can modify MCP tool logic.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-64773)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to a race condition. A remote user can bypass helpdesk Agent limit.
Remediation
Install update from vendor's website.
References
- https://www.jetbrains.com/privacy-security/issues-fixed/#d3f801a78f581a6829d82b74c92784a6
- https://www.jetbrains.com/privacy-security/issues-fixed/#6cca1ec036e309e6332302dd7255b54a
- https://www.jetbrains.com/privacy-security/issues-fixed/#84194509dee3040880175b438ab05542
- https://www.jetbrains.com/privacy-security/issues-fixed/#4bf824f8b0c199ecace953cbd6e62d0c
- https://www.jetbrains.com/privacy-security/issues-fixed/#dc1357d85e2d2e49727a6e02082979b7
- https://www.jetbrains.com/privacy-security/issues-fixed/#5282e1d7912745ea76355a5e1879544a
- https://www.jetbrains.com/privacy-security/issues-fixed/#a051f0cd28bdf7a75b8d9a2df248bd1c
- https://www.jetbrains.com/privacy-security/issues-fixed/#712a6ee5e4e9f96b9cec22a9b4de810a