JetBrains YouTrack app widget host accepts REST requests without user confirmation
Apps in this issue tracker can act for you without asking first.
Summary
Improper URL validation in the YouTrack app widget host lets apps send REST requests without user confirmation. Affected are YouTrack versions before the fixed releases.
What to do
Update YouTrack to 2025.3.170763, 2026.1.14150, or 2026.2.19656 or later on its line.
Update to at least the version for your product:
- JetBrains YouTrack 2025.3 2025.3.170763 or later
- JetBrains YouTrack 2026.1 2026.1.14150 or later
- JetBrains YouTrack 2026.2 2026.2.19656 or later
Products and platforms
CVE IDs
Times
First published
First seen