JetBrains YouTrack CVE-2026-100270

Exploitation requires an authenticated YouTrack account that has been granted the low-level Admin Read permission; a completely unprivileged or anonymous user cannot trigger it. The specific vector is the import configuration feature, from which integration credentials are exposed. Limiting factors: the required Admin Read administrative permission (PR:H), high attack complexity (AC:H per vendor), and confinement to instances running a version before 2026.2.19197 that actually have integrations configured with stored credentials. Impact is bounded to disclosure of those credentials (low confidentiality), with no user interaction needed.

This is a low-priority, high-CVSS-is-not-the-issue case - the CVSS base score is only 3.3, and every real-world signal reinforces low urgency. The vendor CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) requires high privileges (PR:H - a user already granted the low-level Admin Read permission), high attack complexity (AC:H), and yields only low confidentiality and low integrity impact with no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The one meaningful downstream concern the raw score understates is that the disclosed asset is integration credentials, which could be replayed against connected external systems - but that lateral effect is not captured in the S:U base scope and remains speculative absent detail on which integrations are affected. Note also a minor internal inconsistency: the flaw is described as pure credential disclosure (a confidentiality problem, CWE-863 incorrect authorization) yet the vendor assigns I:L; integrity impact for a read-only disclosure is questionable and worth verifying with JetBrains.

A YouTrack user who has been granted only the low-level Admin Read permission opens or exports an import configuration and reads stored third-party integration credentials that their permission level should not expose. They then reuse those credentials to access the connected external service. No public proof-of-concept was provided in the input, and the high attack complexity means the disclosure path is not trivially triggered.