JetBrains YouTrack: Authorization bypass in scripts debugger
Summary
An authorization bypass in the scripts debugger of JetBrains YouTrack before 2026.2.19197 allows arbitrary code execution. The CVE record classifies the flaw as CWE-863 (Incorrect Authorization). Sources disagree on the CVSS score and the required privileges, so verify both in NVD. The impact is limited to instances where the scripts debugger is enabled and reachable.
Affected
- JetBrains YouTrack versions before 2026.2.19197 (self-hosted and cloud, per the CVE record range 0 to < 2026.2.19197)
Fixed in
- Upgrade to YouTrack 2026.2.19197 or later. Newest server builds listed by JetBrains in October 2026: 2026.2.19728, 2026.1.14165 and 2025.3.172487 (not confirmed against the advisory for this CVE).
Workaround
- Unknown. No vendor workaround was found for this CVE.
- Interim measures (not from a vendor source): restrict scripts-debugger access to a small admin group, review who holds administrator or script-editing rights, and keep YouTrack off the public internet until patched.
Exploitation
- Not listed in CISA's Known Exploited Vulnerabilities catalog.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept found. This does not rule one out.
Our recommendation
- Upgrade every self-hosted YouTrack instance to 2026.2.19197 or later, together with other YouTrack fixes from the same release train.
- Until patched, restrict scripts-debugger access and review administrator and script rights.
- Do not expose YouTrack directly to untrusted networks.
- Check NVD for the official CVSS score and vector before setting internal priority.
- Priority: high for internet-reachable or large instances, medium for internal-only instances with few accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains fixed security issues www.jetbrains.com
- OpenCVE: CVE-2026-100273 app.opencve.io
- OffSeq Radar: CVE-2026-100273 radar.offseq.com
- HOL Guard: CISA ADP Vulnrichment for CVE-2026-100273 hol.org
- Strix: CVE-2026-100273 www.strix.ai
- JetBrains security blog: certificate authority incident and guidance (October 2026) blog.jetbrains.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:50.
Original description (NVD)
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.