Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

JetBrains YouTrack allows account takeover via email

CVE-2026-86478 · published 1 month ago
Summary

YouTrack versions before the 2025.3.161254 and 2026.1.14042 releases let anyone claim an email address and gain access to an account without logging in. This could let attackers take over user accounts and view or change data. Update to the latest YouTrack release to close the gap.

What to do
  • Update jetbrains youtrack to version 2025.3.161254, 2026.1.14042 or later.
Affected software
VendorProductAffected versions
jetbrains youtrack < 2025.3.161254, 2026.1.14042
Original advisory text
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published7 Sep 2026
Updated7 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-86478 · NVD
CVE-2026-86478 · MITRE
Track software like this
Free during beta