CVE-2026-100262 is a High (CVSS 7.6) missing authorization flaw in JetBrains YouTrack. Users with read-only project access could overwrite project notification templates. The record says versions before 2026.2.18991 are affected. Update to 2026.2.18991 or later, then review the templates on your projects.
What's affected
The record says JetBrains YouTrack before 2026.2.18991 is affected. The weakness is CWE-863 (incorrect authorization). The description is short: missing authorisation allowed users with read-only project access to overwrite project notification templates.
The CVSS 3.1 vector in the record is network, low complexity, low privileges required, no user interaction, with unchanged scope. The impact is rated high on integrity and low on confidentiality and availability, which fits a flaw that lets someone change content they should only be able to view.
The only reference in the record is the JetBrains "Fixed security issues" page. When we fetched that page, it returned no readable detail on this entry, so we could not confirm anything beyond the record: the fixed version of 2026.2.18991 and the one line description. Check the JetBrains page directly for the current wording and for any note about hosted instances.
How to check if you're exposed
Open your YouTrack administration area and read the version. In YouTrack this is shown in the Administration section under the About information, and it also appears in the footer of some installations. If the build number is lower than 2026.2.18991, you are in scope.
Next, check whether the weakness could have been used. Notification templates control the text of emails and other messages sent to your users. Review the templates on each project, look at who edited them last, and compare them to what you expect. A changed template might carry misleading text or links that your users would trust, because it comes from your own system.
Also review who has read-only access to projects. The flaw needs a signed in user, so the more people hold access, the more reason there is to check.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Read the YouTrack build number and compare it to 2026.2.18991.
- Update to 2026.2.18991 or later using JetBrains guidance for your install type.
- Review the notification templates for every project and restore any you do not recognise.
- Check the list of users with read-only access, and remove accounts that are no longer needed.
- Check the JetBrains fixed issues page for any extra advice for your deployment.
Why it matters
Missing authorization is one of the most common web application flaws. The server accepts a request from a signed in user and does not ask whether that user may make the change. Here, the affected action was editing notification templates.
The risk is less about the template itself and more about trust. Messages sent from a company issue tracker are read and acted on. A rewritten template could steer readers to a bad link. The record does not mark the CVE as known exploited, and no exploitation reports appear in the sources we reviewed.
Quick check
Which YouTrack version fixes CVE-2026-100262?
The record says versions before 2026.2.18991 are affected, so 2026.2.18991 or later is the fixed range. Confirm on the JetBrains security page.
Do attackers need an account?
Yes. The record says users with read-only project access could do it, so the attacker must be signed in with at least that access.
Sources
Last reviewed: 18 October 2026.
