CVE-2026-62422 is a maximum severity (CVSS 10.0) authentication bypass in JetBrains YouTrack. Direct database access could lead to administrative access. The record lists fixed builds per release line, from 2026.1.13757 down to 2024.2.148429. Update your line now and keep the database off untrusted networks.
What's affected
YouTrack is affected before these builds, one per release line:
- 2026.1 before 2026.1.13757
- 2025.3 before 2025.3.148033
- 2025.2 before 2025.2.148048
- 2025.1 before 2025.1.148120
- 2024.3 before 2024.3.148430
- 2024.2 before 2024.2.148429
Weakness: CWE-306, missing authentication for a critical function. CVSS 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. I read the fixed builds from the record, since the JetBrains page did not load.
How to check if you're exposed
Check the build number your YouTrack reports and compare it with the list for your release line. If you run a self hosted instance, the build is visible in the administration area or on the server's install. If JetBrains hosts your instance, check with JetBrains or your admin whether they have applied the fix.
Also check the database path. The record's wording points to direct database access, so find out what network paths lead to the database or to the service's data store. Your deployment documentation and firewall rules will show it.
What to do now
- Find every YouTrack instance and its build number.
- Update to the fixed build for your release line, or move to a supported newer line.
- Keep the database and data store off any network that untrusted users or systems can reach.
- Review administrator accounts and recent admin actions for anything you do not recognize.
- Rotate admin credentials and integration tokens if you find anything odd.
Why it matters
An issue tracker holds roadmap detail, customer reports and often links into source code and deploy tools. Full administrative access to it is a serious loss. The record describes an authentication bypass through direct database access, with changed scope, which explains the top score.
The weakness is CWE-306: a critical function that does not require authentication. The record's KEV flag is false, and I found no report of attacks in the sources I could read.
Quick check
How do I know which fixed build applies to me?
Match your release line to the list above. Each line has its own fixed build.
Is it exploited in the wild?
The record's KEV flag is false and I found no report of attacks.
Sources
- JetBrains fixed security issues page (listed in the record, but its entries did not load when I reviewed it)
Last reviewed: 19 October 2026.
