CVE-2026-49368: JetBrains YouTrack Stored XSS in Notification Templates (CVSS 8.7)

Technical summary

CVE-2026-49368 is a stored XSS vulnerability affecting YouTrack's project notification template functionality. The vulnerability requires authenticated access (PR:L) and user interaction (UI:R) to exploit, but crosses trust boundaries (S:C), enabling attackers to execute arbitrary JavaScript in victims' browsers with high confidentiality and integrity impact. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), making it practical to exploit once the attacker gains a foothold in the application.

Business impact

Stored XSS in notification templates can lead to credential theft, session hijacking, and unauthorized actions performed on behalf of compromised users. For organizations using YouTrack for project tracking and team collaboration, this creates supply-chain-like risk: an attacker with legitimate (but potentially low-privileged) access can compromise other team members, potentially including administrators. This undermines trust in your project management data and could facilitate lateral movement within integrated DevOps toolchains.

Affected systems

JetBrains YouTrack installations prior to version 2026.1.13162 are vulnerable. On-premises and cloud-hosted instances are equally affected. Any user who has authenticated access to YouTrack can craft malicious notification templates; any user who views those notifications risks exploitation.

Exploitability

Exploitation requires an authenticated user account and victim interaction (viewing a notification), keeping the CVSS base score at 8.7 rather than critical. The attack is not wormable or self-propagating. However, the low barrier to entry for authenticated users and the persistence of stored payloads make this a practical attack surface for insider threats or compromised lower-privileged accounts. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade YouTrack to version 2026.1.13162 or later. This version patches the XSS filtering in project notification templates. Organizations should prioritize this update if YouTrack is used by sensitive teams or contains business-critical project data. After patching, audit existing notification templates for suspicious content.

Patch guidance

Apply the official JetBrains YouTrack update to 2026.1.13162 or higher. Consult the JetBrains advisory for version-specific upgrade paths and any potential compatibility considerations. Verify the patch by confirming the version number in YouTrack's administration interface post-update. Organizations on maintenance contracts should also check for any supplementary hardening or rollback guidance from JetBrains support.

Detection guidance

Monitor YouTrack audit logs for creation or modification of notification templates, particularly by lower-privileged accounts or outside normal change windows. Look for templates containing script tags, event handlers (onclick, onload, etc.), or HTML entities that might encode XSS payloads. Endpoint detection platforms should flag script execution originating from YouTrack URLs or tabs. Query web access logs for unusual POST/PUT activity to notification template endpoints.

Why prioritize this

This vulnerability scores 8.7 (HIGH) due to high confidentiality and integrity impact in a cross-boundary context, combined with network accessibility and low complexity. Although it requires authentication and user interaction, the stored nature of the XSS and the ease of exploitation by any authenticated user make it a meaningful risk for organizations where YouTrack is widely accessible or where user accounts may be shared or compromised. Prioritize patching in environments with sensitive project data or integrated CI/CD pipelines.

Risk score, explained

CVSS 8.7 reflects the combination of network accessibility, low attack complexity, and high impact on confidentiality and integrity. The requirement for authentication (PR:L) and user interaction prevents a critical rating, but the cross-boundary scope (S:C) and persistence of stored XSS in a collaborative tool elevate the score significantly. Organizations managing large teams or handling regulated data should weight this accordingly in their risk model.

Frequently asked questions