Dashboard / CVE-2026-123323

CVE-2026-123323

HIGH
MEDIUM Priority: 0.02 BB Relevance: 52/100
Published: 2026-11-06 Modified: 2026-11-10 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Required
S: Changed
C: High
I: High
A: High

Description

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
JetBrains YouTrack 0 < 2025.3.170763, 2026.1.14150, 2026.2.19656
JetBrains YouTrack 0 < 2025.3.170763, 2026.1.14150, 2026.2.19656

References & Advisories (1)

Bug Bounty Relevance

52 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

8.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.28%
Raw Score 0.002800
Percentile 20.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00280
2026-11-12
0.00280
2026-11-10
0.00280
2026-11-09
0.00280
2026-11-08
0.00280
2026-11-07
0.00280

Intelligence Sources

mitre ref →
nvd ref →

External Links