In JetBrains YouTrack prior to 2020.1.1331, an external user could execute commands against arbitrary issues.
jetbrains youtrack