CVE-2026-123326: YouTrack auth bypass in script debugger (high)

Summary

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

cve.now Index

10Pcve.now Index 10 of 100 · methodology v3 · provisional

Exploitation0/40No signal
Exposure3/25Reachable over the network · Unknown: No advisory context yet
Reach?/20Unknown. No tracked technology or package matched
Severity7.1/10CVSS 7.1
No patch0/5No signal

What would change the score

Would score about 65 if added to CISA KEV
Would score about 60 if CISA's SSVC rates exploitation active
Would score about 29 if advisories confirm default setups are exposed

How the score works · Leaderboard

What to do

Upgrade to a fixed version: 2026.2.19197.

Timeline

Nov 6, 2026, 10:28 AM UTCCVE published
Nov 6, 2026, 10:34 AM UTCFirst seen by cve.now
Nov 6, 2026, 2:36 PM UTCCISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
Nov 6, 2026, 2:38 PM UTCRecord last updated

Affected versions

JetBrains YouTrack
fixed in 2026.2.19197

Evidence 1

Link
jetbrains.com · privacy-security/issues-fixed

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-123326

Is CVE-2026-123326 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-123326?

YouTrack: before 2026.2.19197.Source: cve.now feed data

How do I fix CVE-2026-123326?

Upgrade to a fixed version: 2026.2.19197.Source: cve.now feed data