SB20260817104 - Multiple vulnerabilities in YouTrack

Description

This security bulletin contains information about 3 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-75044)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete arbitrary entities.

The vulnerability exists due to improper authorization in the mailbox endpoint when handling requests. A remote user can send a crafted request to delete arbitrary entities.

2) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-75045)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to download database backups.

The vulnerability exists due to improper authentication in shared draft signature handling when accessing backup download functionality. A remote attacker can use a shared draft signature to download database backups.

3) Missing Authorization (CVE-ID: CVE-2026-75046)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the users search endpoint when handling authenticated search requests. A remote user can query the endpoint to disclose sensitive information.

Remediation

Install update from vendor's website.

References

• https://www.jetbrains.com/privacy-security/issues-fixed/#d6cf714a3a58a6440d823e61b1061c02
• https://www.jetbrains.com/privacy-security/issues-fixed/#e83d2412d05dfe52b362ab7edf9edbe8
• https://www.jetbrains.com/privacy-security/issues-fixed/#de6d84764e66862301f72a9f5ffdace4