CVE-2026-75045: Unauthenticated Attacker Could Download YouTrack Database Backups
Do Son 
TL;DR
JetBrains fixed eight security flaws in YouTrack, its issue-tracking platform. The most serious, CVE-2026-75045, is rated Critical. It let an unauthenticated attacker download database backups through a shared draft signature. No exploitation in the wild has been reported.
- Total: 8 CVEs
- Severity: 1 Critical · 4 High · 3 Medium
- Actively exploited: None confirmed
- Highest severity: 9.1 (Critical · CVSSv3) — CVE-2026-75045
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-75045 | 9.1 | CWE-288 | 2025.3.156085, 2026.1.13913, 2026.2.18112 | Not exploited |
| CVE-2026-75048 | 8.2 | CWE-79 | 2026.2.18068 | Not exploited |
| CVE-2026-75044 | 8.1 | CWE-862 | 2025.3.156085, 2026.1.13914, 2026.2.18095 | Not exploited |
| CVE-2026-75051 | 8.1 | CWE-862 | 2026.2.17917 | Not exploited |
| CVE-2026-75050 | 7.1 | CWE-770 | 2026.1.13901, 2026.2.17950 | Not exploited |
| CVE-2026-75047 | 6.5 | CWE-409 | 2026.2.18177 | Not exploited |
| CVE-2026-75049 | 6.5 | CWE-862 | 2026.1.13903, 2026.2.17950 | Not exploited |
| CVE-2026-75046 | 4.3 | CWE-862 | 2026.2.18112 | Not exploited |
Why It Matters
YouTrack stores issues, projects, and internal team data. A database backup holds that entire dataset. With CVE-2026-75045, an unauthenticated attacker could download database backups and seize it all.
No login is needed, which lowers the bar sharply. As a result, network access to a vulnerable instance may be enough. Vietnamese researcher Hieu Nguyen reported the critical flaw to JetBrains.
How the Attacks Work
The critical bug abuses a shared draft signature. Improper handling of that signature exposed backup downloads to outsiders. This report describes the mechanism only.
The Other Seven Flaws
The remaining issues range from Medium to High severity. Several stem from missing authorization (CWE-862). One High-rated flaw let an authenticated user delete arbitrary entities through the mailbox endpoint. Another allowed unauthorized project transfer between organizations.
Two flaws enabled denial of service, one via a decompression bomb and one via crafted type parameters. A stored XSS bug lived in the fenced code-block language label. Other flaws let authenticated users enumerate accounts or read restricted articles from other projects.
Affected Versions
The flaws affect YouTrack releases before the patched builds. The critical backup flaw is fixed in 2025.3.156085, 2026.1.13913, and 2026.2.18112. Other fixes land across builds up to 2026.2.18177.
Patch and Mitigation Steps
Upgrade YouTrack to the latest patched build as soon as possible. JetBrains Cloud instances receive fixes automatically. Self-hosted operators must update themselves.
Until you patch, restrict network access to YouTrack hosts. You should also limit direct access to backup files. Full details appear on the JetBrains security issues fixed page. No public proof-of-concept exploit has been released for these flaws.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
