JetBrains YouTrack CVE-2026-100278

Requires a valid authenticated YouTrack account that has been granted at least some (restricted/limited) permission within a project - the flaw lets such a user act on other users' comments without the proper authorization check. Exploitation is limited by the need for an existing account (no anonymous access) and produces only integrity impact (editing/hiding comments); there is no data disclosure or service disruption. The description's 'restricted permission' phrasing indicates a low-privilege user suffices, which contradicts the vendor's PR:H rating. Applies to all YouTrack versions before 2026.2.19197 in default configuration; no special feature toggle or non-default setting is named.

This is a genuine but low-to-moderate priority authorization flaw, not a high-urgency issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) describes network-reachable, low-complexity exploitation with NO confidentiality or availability impact - the sole impact is integrity (I:H), consistent with CWE-863 (improper authorization) letting a user tamper with data they should not control. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is: no public exploit identified at time of analysis. A notable conflict exists in the privileges metric: the description says 'users with restricted permission' (implying a low-privilege account, PR:L), yet the vendor rated it PR:H; if PR:L is correct the base score rises to roughly 5.4. This is a signal worth verifying with JetBrains, but it does not change the fundamental picture - the flaw requires an authenticated account and only permits comment tampering, so real-world risk is bounded. No conflict exists between attack vector and description; both point to authenticated network access.

An authenticated YouTrack user who has been granted only restricted/limited permissions on a project navigates to an issue and, exploiting the missing authorization check, edits or hides comments authored by other users - content they should have no rights to modify. No public exploit code is available, but the low attack complexity (AC:L) and network vector mean any logged-in user with a valid session could trigger it through the normal comment UI or API.