Authorization Flaw in JetBrains YouTrack Leads to Project Notification Template Overwrites
CVE-2026-100262

7.6HIGH

Key Information:

Vendor

Jetbrains
Status
Youtrack
Vendor
CVE Published:
30 September 2026

What is CVE-2026-100262?

In JetBrains YouTrack versions before 2026.2.18991, an authorization flaw has been identified that permits users with read-only access to projects to overwrite project notification templates. This issue raises concerns about project integrity and unauthorized modifications, potentially impacting communication and workflows if not addressed promptly.

Affected Version(s)

YouTrack 0 < 2026.2.18991

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.