CVE-2026-100276 is a Medium (CVSS 5.9) authorization flaw in JetBrains YouTrack. Guest users could remove the visibility restriction on a workflow action and then run it. The record says versions before 2026.2.19197 are affected. Update to 2026.2.19197 or later and review your workflow actions.
What's affected
The record says JetBrains YouTrack before 2026.2.19197 is affected, and the weakness is CWE-863 (incorrect authorization). Guest users could remove a workflow action's visibility restriction and run the action.
The CVSS 3.1 vector is network, high attack complexity, no privileges, no user interaction, with high impact on integrity and none on confidentiality or availability. The high complexity is part of why the score sits in the Medium band.
The record's only reference is the JetBrains "Fixed security issues" page, which returned no readable entry when we fetched it. We could not confirm further affected or fixed versions beyond 2026.2.19197, and we did not find any statement about cloud hosted instances. Read the JetBrains page for the current detail.
Note the second YouTrack issue published on the same date, CVE-2026-100262, which is fixed in an earlier build, 2026.2.18991. Moving to 2026.2.19197 or later covers both.
How to check if you're exposed
Check the YouTrack version in the administration area. If it is lower than 2026.2.19197, update.
Then look at whether guest access is on at all. If your instance has no guest account, or guest access is switched off for the projects that hold workflow actions, the attack surface is smaller. If guests are allowed, list the workflow actions that are restricted from guests, since those are the ones the flaw could have exposed.
Review the actions themselves. Workflow actions can change issue fields, move issues between states or trigger other automation. Look at recent history for runs by the guest account that you cannot explain.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Check the YouTrack build and update to 2026.2.19197 or later.
- Decide whether guest access is needed. Turn it off where it is not.
- Review workflow actions with visibility restrictions and what each one does.
- Look for actions run by the guest account in recent history.
- Confirm the exact fix details on the JetBrains fixed security issues page.
Why it matters
A visibility restriction on a workflow action is an access control. If an unauthenticated or lowest privilege user can remove it, the control does not hold, and the action becomes available to anyone who can reach the instance.
How much that matters depends on what your actions do. A harmless one might only add a comment. A powerful one might close issues or change assignees. The record does not mark the CVE as known exploited.
Quick check
Is this exploitable without logging in?
The record says guest users, which means the built-in guest account rather than a named user. If guest access is off on your instance, you are less exposed.
Why is the score only Medium?
The vector lists high attack complexity and limited impact on some of the three impact measures, which gives 5.9.
Sources
Last reviewed: 18 October 2026.
