JetBrains YouTrack CVE-2026-100268

Exploitation requires an authenticated account holding project-administrator privileges (PR:L) within JetBrains YouTrack before 2026.2.19197, and use of the notification-templates feature as the disclosure vector. The limiting factor is the required project-admin role - a non-trivial privilege level - meaning the realistic threat actor is a malicious or compromised project administrator rather than an anonymous remote attacker. No user interaction by a victim is needed (UI:N). Impact is confined to reading comment content from other projects; there is no integrity or availability effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7 High) describes a network-exploitable, low-complexity information-disclosure flaw that requires an existing authenticated privileged account (PR:L - a project administrator) and produces a confidentiality-only impact with a scope change (S:C), since the attacker crosses a project trust boundary to read data belonging to projects they do not administer. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is moderate rather than urgent: exploitation is gated behind a legitimate project-administrator role (an insider or a compromised admin account), the impact is limited to disclosure of comment content (no integrity or availability loss), and the vendor-assigned 7.7 is driven largely by the S:C scope change and C:H rating. This is a genuine but contained access-control defect - priority is tied to how sensitive cross-project comment data is in a given deployment - rather than a broadly exploitable internet-facing threat. Note the input tag 'Authentication Bypass' is misleading: CWE-639 is an authorization/IDOR issue (privilege boundary bypass), not authentication bypass.

A user holding project-administrator rights on one YouTrack project crafts or manipulates a notification template that references or renders comment data, causing the server to expose comments belonging to other projects the attacker has no rights to. No public exploit code was provided, and exploitation requires the attacker to already hold a project-admin role, so this is most realistic as insider abuse or via a compromised administrator account over the network.