CVE-2026-100273 is an authorisation bypass in the scripts debugger of JetBrains YouTrack that allowed arbitrary code execution. NVD scores it 8.2, high severity. The record says versions before 2026.2.19197 are affected, so upgrade self hosted installs to 2026.2.19197 or later and review who can use scripting.
What's affected
The CVE record says: "In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution."
- Product: JetBrains YouTrack, the issue tracker.
- Affected: versions before 2026.2.19197.
- Fixed: 2026.2.19197, going by the record.
- Severity: CVSS 8.2, vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. Low privileges are required, complexity is high, and the scope is changed. - Exploitation: neither the record nor any source I could read reports exploitation. It is not on the CISA KEV list.
JetBrains publishes the details on its Fixed security issues page. When I tried to read that page it loaded as a script-driven shell with no advisory text, so this post relies on the CVE record for versions and descriptions. Confirm against the page before you act on a version number.
How to check if you're exposed
Check your YouTrack version in the product's administration area, or in the image tag or package version for a container or packaged install. Anything below 2026.2.19197 is in scope.
If you use the hosted service, JetBrains runs the version, so look for guidance from JetBrains on whether you need to do anything. I could not confirm that from the record.
For self hosted installs, think about who holds an account. The vector lists low privileges, so an ordinary user is assumed. Public or wide open registration, or a long list of guest and contractor accounts, widens the pool of people who could try it. Also check who can use YouTrack workflows and scripting, because the debugger belongs to that feature.
What to do now
- Upgrade self hosted YouTrack to 2026.2.19197 or later, following JetBrains instructions for your install.
- Reduce the number of accounts that can reach scripting and workflow features. Keep those rights with the few administrators who need them.
- Review recent changes to workflows and scripts for entries you do not recognise.
- Restrict network access to the server to your staff networks or a VPN if you can.
- Check what the YouTrack service account can reach on the host and the network, and trim it. Code execution runs with the rights of that account.
Why it matters
The weakness is CWE-863, incorrect authorization. A feature that should be reserved for people with the right role could be used by someone with lower rights. Here the feature is a debugger for YouTrack scripts, which by design runs code. Debug tools are powerful, so a gap in who may use them is more serious than a gap in a read only page.
The CVSS scope is changed, meaning the impact can leave the YouTrack application itself. An issue tracker often holds links, tokens and integrations to source control and chat, and in some teams it holds sensitive bug reports and security findings. Code running on the host can read those.
The attack complexity is rated high and the account must exist, which narrows the field, but a bypass in an authorisation check is the kind of thing that people look for once the fix is public. Plan the upgrade now.
Quick check
Does this need a logged in user?
The CVSS vector lists low privileges required, so an account is assumed. Registered users, guests and contractors count.
Which version fixes it?
The record says versions before 2026.2.19197 are affected, so 2026.2.19197 or later fixes it. Confirm on the JetBrains page.
Sources
Last reviewed: 19 October 2026.
