CVE-2026-123323
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in…
- Risk score
- 50/100
- CVSS
- 8.4 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
- Affected
- See advisory
- Fix
- Upgrade the product to 2025.3.170763, 2026.1.14150 or 2026.2.19656 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
References
Original description
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
Last activity 6 Nov 2026. Patch Forecast updates every hour.