CVE-2026-75044CWE-862broken-access-control

CVE-2026-75044

High · published August 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

In JetBrains YouTrack before 2025.3.156085,

2026.1.13914,

2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-17T20:17Z
Affected products (3)
ProductVersionsFixed in
jetbrains/youtrack< 2025.3.1560852025.3.156085
jetbrains/youtrack≥ 2026.1, < 2026.1.139142026.1.13914
jetbrains/youtrack≥ 2026.2, < 2026.2.180952026.2.18095
References (1)
https://www.jetbrains.com/privacy-security/issues-fixed/ · [email protected]
EPSS history
Timeline
  • 17 AUG 15:54Z
    In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via…
    cvelistv5