SB2025111101 - Multiple vulnerabilities in JetBrains YouTrack
Published: November 11, 2025 Updated: November 11, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2025-64686)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to a missing user principal cleanup. A remote user can gain access to the application within an incorrect authorization context.
2) Improper Certificate Validation (CVE-ID: CVE-2025-64685)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper certificate validation. A remote attacker can perform MitM attack and gain access to sensitive information.
3) Missing Authorization (CVE-ID: CVE-2025-64684)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing authorization checks within the the feedback form. A remote attacker can gain access to sensitive information.
4) Missing Authorization (CVE-ID: CVE-2025-64690)
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to missing authorization checks. A remote authenticated user can gain access to sensitive information and perform unauthorized changes.
5) Insufficiently protected credentials (CVE-ID: CVE-2025-64689)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect configuration in the Junie could. A remote attacker can gain unauthorized access to the global Junie token and compromise the repository.
6) Authorization bypass through user-controlled key (CVE-ID: CVE-2025-64688)
The vulnerability allows a remote user to gain unauthorized access to the application.
The vulnerability exists due to missing access restrictions. A remote authenticated user can manipulate the VCS URL and manage repositories from the Junie widget.
7) Missing Authorization (CVE-ID: CVE-2025-64687)
The vulnerability allows a remote user to alter application behavior.
the vulnerability exists due to missing authoreization checks. A remote user can modify MCP tool logic.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-64773)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to a race condition. A remote user can bypass helpdesk Agent limit.
Remediation
Install update from vendor's website.
References
- https://www.jetbrains.com/privacy-security/issues-fixed/#d3f801a78f581a6829d82b74c92784a6
- https://www.jetbrains.com/privacy-security/issues-fixed/#6cca1ec036e309e6332302dd7255b54a
- https://www.jetbrains.com/privacy-security/issues-fixed/#84194509dee3040880175b438ab05542
- https://www.jetbrains.com/privacy-security/issues-fixed/#4bf824f8b0c199ecace953cbd6e62d0c
- https://www.jetbrains.com/privacy-security/issues-fixed/#dc1357d85e2d2e49727a6e02082979b7
- https://www.jetbrains.com/privacy-security/issues-fixed/#5282e1d7912745ea76355a5e1879544a
- https://www.jetbrains.com/privacy-security/issues-fixed/#a051f0cd28bdf7a75b8d9a2df248bd1c
- https://www.jetbrains.com/privacy-security/issues-fixed/#712a6ee5e4e9f96b9cec22a9b4de810a