CVE-2026-75044: JetBrains Youtrack

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Affected products

• JetBrains Youtrack: before 2025.3.156085 (fixed in 2025.3.156085); from 2026.1, before 2026.1.13914 (fixed in 2026.1.13914); from 2026.2, before 2026.2.18095 (fixed in 2026.2.18095)

Published 2026-08-17. Last modified 2026-09-15.