CVE-2026-86498
Received Received - Intake

Stored XSS via PUT Request in JetBrains YouTrack

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: JetBrains s.r.o.

Description
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86498
EUVD
EUVD-2026-72514

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetbrains youtrack to 2025.3.160480 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047, a vulnerability exists where PUT requests on link sub-resources could allow attackers with sufficient permissions to modify linked entities without having the required update permission.

Impact Analysis

This vulnerability could allow unauthorized modification of linked entities in YouTrack, potentially leading to data integrity issues or unintended changes in project management data. Attackers with network access and basic permissions might exploit this to alter relationships between issues, projects, or other tracked elements.

Mitigation Strategies

Update JetBrains YouTrack to version 2025.3.160480 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart