CVE-2026-123323

EUVD-2026-118087
In JetBrains YouTrack before 2025.3.170763, 
2026.1.14150, 
2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.4 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://www.jetbrains.com/privacy-security/issues-fixed/