CVE-2026-62422CWE-306

CVE-2026-62422

Critical · published July 14, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

In JetBrains YouTrack before 2026.1.13757,

2025.3.148033,

2025.2.148048,

2025.1.148120,

2024.3.148430,

2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-14T15:16Z
Affected products (6)
ProductVersionsFixed in
jetbrains/youtrack< 2024.2.1484292024.2.148429
jetbrains/youtrack≥ 2024.3.44799, < 2024.3.1484302024.3.148430
jetbrains/youtrack≥ 2025.1.62455, < 2025.1.1481202025.1.148120
jetbrains/youtrack≥ 2025.2.86069, < 2025.2.1480482025.2.148048
jetbrains/youtrack≥ 2025.3.87341, < 2025.3.1480332025.3.148033
jetbrains/youtrack≥ 2026.1.12024, < 2026.1.137572026.1.13757
References (1)
https://www.jetbrains.com/privacy-security/issues-fixed/ · [email protected]
EPSS history
Timeline
  • 14 JUL 10:17Z
    In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…
    cvelistv5