JetBrains YouTrack CVE-2026-100280

Requires an authenticated YouTrack user with low privileges (PR:L) on an instance running a version before 2026.2.19197, plus the existence of a custom project template the attacker cannot read; exploitation occurs through the project-creation flow that fails to enforce the template's read-permission check. Limiting factors: valid account required (no unauthenticated access), high attack complexity (AC:H) implying specific permission/template preconditions, impact confined to low confidentiality disclosure of template data, and no integrity or availability effect. Not exploitable against patched instances (2026.2.19197 or later).

This is a low-risk authorization flaw despite the network attack vector. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N = 3.1 LOW) tells a consistent, low-severity story: an already-authenticated low-privilege user (PR:L) can, under non-trivial conditions (AC:H), create a project from a custom template they lack read permission on. Impact is limited to low confidentiality (C:L) - indirect exposure/use of template contents the user should not access - with no integrity or availability impact. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so all three exploitation-likelihood signals are absent rather than elevated. No SSVC decision data was provided. The issue was self-reported by JetBrains (not discovered through in-the-wild exploitation), which further argues for opportunistic disclosure rather than active targeting. Net: a real-but-minor authorization hardening fix, not an urgent priority. One data caveat: the 'Authentication Bypass' tag overstates the flaw - this is a missing-authorization / broken-access-control issue (CWE-862), not a true authentication bypass.

An authenticated YouTrack user with only low privileges creates a new project and selects a custom project template that they do not have permission to read, causing YouTrack to apply and expose that template's configuration/contents. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) suggests specific template/permission preconditions must be met.