CVE-2026-123323

Summary

In JetBrains YouTrack before specific patch versions, improper URL validation in the app widget host allowed authenticated apps to send arbitrary REST requests without user confirmation, bypassing expected authorization checks and enabling unauthorized data access or modification.

Exploitability

Exploitation requires a compromised or malicious app with valid authentication (PR:H) and user interaction (UI:R), such as clicking a widget, making it moderately difficult in practice.

Blast radius

If exploited, an attacker could read or modify sensitive YouTrack data (issues, projects, users) via forged REST requests, leading to credential theft, data exfiltration, or system compromise within the YouTrack instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to YouTrack 2025.3.170763, 2026.1.14150, or 2026.2.19656 (or later) to patch the improper URL validation flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.