CVE-2026-100280

Analyzed Analyzed - Analysis Complete

Unauthorized Project Creation via Unreadable Template in JetBrains YouTrack

Publication date: 2026-09-30

Last updated on: 2026-10-02

Assigner: JetBrains s.r.o.

Description

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100280

EUVD

EUVD-2026-90024

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	youtrack	to 2026.2.19197 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in JetBrains YouTrack before version 2026.2.19197 allows an attacker with limited privileges to create a project using an unreadable custom template. This could lead to unauthorized access or unintended project configurations.

Detection Guidance

This vulnerability is specific to JetBrains YouTrack versions before 2026.2.19197 and involves unauthorized project creation from unreadable custom templates. To detect it, check your YouTrack version using the admin panel or API. If your version is below 2026.2.19197, the system is vulnerable.

Impact Analysis

An attacker could exploit this to create projects with unintended settings or access controls, potentially leading to data exposure or system misuse. The low CVSS score suggests limited impact but still poses a risk.

Compliance Impact

The vulnerability in JetBrains YouTrack before 2026.2.19197 allows unauthorized project creation from unreadable custom templates, which could lead to improper data handling or exposure. This may impact compliance with GDPR by risking unauthorized access to personal data or HIPAA by failing to protect sensitive health information.

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.19197 or later to address the vulnerability related to project creation from unreadable custom templates.

Hi! I’m here to help you understand CVE-2026-100280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70