JetBrains YouTrack CVE-2026-100271

Requires an authenticated YouTrack account with existing access to the instance (PR:H); the flaw is that several endpoints omit per-project authorization checks, letting such a user read data from projects they are not authorized for. Exploitation is limited by the need for valid credentials and by the fact that impact is confined to confidentiality of other projects' information - no data modification, no privilege gain, and no unauthenticated access. Affects YouTrack versions before 2026.2.19197.

This is a low-severity broken-access-control issue (CVSS 2.7), and every available signal points to low real-world priority rather than an underrated critical flaw. The CVSS vector requires high privileges (PR:H) - authenticated users must already have legitimate access to the YouTrack instance - and yields only limited confidentiality impact (C:L) with no integrity or availability effect (I:N/A:N) and no scope change (S:U). No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of active or automated exploitation; exploitation status is best described as no public exploit identified. The one point worth flagging is a tag/CWE mismatch: the issue is tagged 'Authentication Bypass' but the CWE (CWE-862, Missing Authorization) and the description ('missing authorisation on several endpoints') describe an authorization/access-control failure by an already-authenticated user, not an authentication bypass - the label overstates the nature of the flaw. Net: a genuine but minor cross-project information-disclosure bug, appropriately rated low, meaningful mainly to organizations that segregate sensitive projects within a shared YouTrack instance.

An authenticated YouTrack user who has legitimate access to at least one project sends requests directly to several endpoints that fail to enforce per-project authorization, reading issue or project information belonging to other projects they should not be able to see. No public exploit code is identified, and the attacker must already hold valid credentials on the instance.