{"id":"CVE-2026-123323","published":"2026-11-06T11:17:11.983","lastModified":"2026-11-10T15:17:16.187","description":"In JetBrains YouTrack before 2025.3.170763, \n2026.1.14150, \n2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In JetBrains YouTrack before specific patch versions, improper URL validation in the app widget host allowed authenticated apps to send arbitrary REST requests without user confirmation, bypassing expected authorization checks and enabling unauthorized data access or modification.","exploitability":"Exploitation requires a compromised or malicious app with valid authentication (PR:H) and user interaction (UI:R), such as clicking a widget, making it moderately difficult in practice.","blast_radius":"If exploited, an attacker could read or modify sensitive YouTrack data (issues, projects, users) via forged REST requests, leading to credential theft, data exfiltration, or system compromise within the YouTrack instance.","remediation":"Upgrade to YouTrack 2025.3.170763, 2026.1.14150, or 2026.2.19656 (or later) to patch the improper URL validation flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","widget-hijack","rest-api-abuse","web-app"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:50:14.624Z"}}