CVE-2026-86491

JetBrains YouTrack versions prior to 2026.2.18634 are vulnerable to stored cross-site scripting (XSS) attacks through the upload of project and organization icons. This vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or session hijacking. Organizations using affected versions should prioritize patching to mitigate this low-severity risk, particularly those with high user interaction or sensitive data management.