CVE-2026-28193: JetBrains Youtrack

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

Affected products

• JetBrains Youtrack: before 2025.3.121962 (fixed in 2025.3.121962)

Published 2026-02-25. Last modified 2026-06-17.