CVE-2026-100258
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVSS
4.3
Medio
EPSS
0.7%
p50
KEV
—
Exploit Today
15
0-100
Publicado: 30 sept 2026 · Última mod.: 2 oct 2026 · CWE-201
0.6%EPSS · 30 días0.8%
2026-10-012026-10-20
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-113459—30.8%
——9In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.18hCVE-2026-196034.3 MED6.8%
——2Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-007655dCVE-2026-196014.9 MED13.4%
——4Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-007645dCVE-2026-195416.5 MED11.6%
——3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-007615dCVE-2026-1103616.5 MED18.1%
——5Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.6dCVE-2026-1096957.5 ALT14.8%
——4Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.6d