CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2026-62422

CVSS 10.0v3.1pub. 2026-07-14upd. 2026-08-12

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Jetbrains Youtrack

    APP
    Jetbrains
    < 2024.2.1484292024.3.44799 – 2024.3.148430 (excl.)2025.1.62455 – 2025.1.148120 (excl.)2025.2.86069 – 2025.2.148048 (excl.)2025.3.87341 – 2025.3.148033 (excl.)2026.1.12024 – 2026.1.13757 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-24442CRITICAL9.8PL ✓same product

Server-Side Template Injection (SSTI) w JetBrains YouTrack via FreeMarker

CVE-2021-43185CRITICAL9.8PL ✓same product

JetBrains YouTrack — podatność Host header injection

CVE-2021-37549CRITICAL9.1PL ✓same product

JetBrains YouTrack — niewystarczający sandbox w workflow

CVE-2021-25770CRITICAL9.8PL ✓same product

Server-Side Template Injection (SSTI) umożliwiający RCE w JetBrains YouTrack

CVE-2019-12852CRITICAL9.8PL ✓same product

SSRF w JetBrains YouTrack umożliwiający nieautoryzowany dostęp do zasobów sieciowych