JetBrains YouTrack CVE-2026-100261

Exploitation requires an authenticated YouTrack account with at least low privileges (CVSS PR:L) on a reachable instance running a version before 2026.2.18991; no user interaction is needed (UI:N). The specific prerequisite is access to the article/knowledge-base feature: the flaw lets a user who lacks the article update permission nonetheless change that article's visibility settings, so the account need not hold the permission that normally gates the action. Limiting factors: it is not exploitable by fully unauthenticated attackers, impact is confined to article visibility (low confidentiality and low integrity, no availability), and instances already updated to 2026.2.18991 or later are not affected.

This is a genuine but modest-severity authorization flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity issue that nonetheless requires an authenticated low-privilege account (PR:L) and yields only low confidentiality and low integrity impact with no availability effect. The core weakness (CWE-288, authentication bypass using an alternate path/channel) manifests here as a broken access-control condition: a user without article update permission can still alter article visibility settings. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no signal of active exploitation - consistent with a vendor-discovered issue (JetBrains self-reported). The realistic risk is an authenticated insider or a compromised low-privilege account manipulating who can see knowledge-base articles, which could expose restricted content or hide legitimate content. Net: a real, patch-worthy authorization defect with limited blast radius, well below the urgency of an unauthenticated RCE or a KEV-listed flaw. Note one tension worth verifying: the input Tags label this 'Information Disclosure', but the underlying CWE-288 and the described behavior are an authorization/access-control bypass whose confidentiality effect is a downstream consequence, not the primary flaw class.

A low-privileged but authenticated YouTrack user (e.g., a reporter or a member of a restricted project) sends a request to modify an article's visibility settings even though they lack the update permission that should gate that action. By flipping a restricted internal article to broader visibility, they read content they were never authorized to see, or conversely restrict an article to disrupt legitimate access. No public exploit code is identified at time of analysis, and exploitation requires a valid account.