CVE-2025-64684: 
YouTrack vulnerability analysis and mitigation

In JetBrains YouTrack before version 2025.3.104432, an information disclosure vulnerability was discovered via the feedback form. The vulnerability was assigned CVE-2025-64684 and was disclosed on November 10, 2025. This security issue affects JetBrains YouTrack installations that have not been updated to the latest version (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization). JetBrains s.r.o., as the CNA, initially assessed it with a CVSS score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability primarily affects the confidentiality of information, with potential unauthorized information disclosure through the feedback form functionality. The impact on integrity and availability is rated as None according to the CVSS scoring (NVD).

The vulnerability has been fixed in JetBrains YouTrack version 2025.3.104432. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).