JetBrains YouTrack CVE-2026-103488

Requires an authenticated YouTrack account with low privileges (PR:L) on an instance before version 2026.2.19422; the attacker must be able to reach the project-team membership functionality and the target project must contain issues whose visibility is restricted to team members. No user interaction, no admin rights, and no non-default configuration are needed - the missing authorization check is the default behavior. The primary limiting factor is the prerequisite valid account, which scopes realistic exploitation to insiders, external reporters, or holders of compromised credentials rather than fully anonymous internet attackers.

This is a genuine but moderate-priority broken-access-control (CWE-863) flaw, not a high-CVSS-but-hollow finding. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N = 7.1) is internally consistent with the description: a network-reachable YouTrack instance where an already-authenticated low-privilege user (PR:L) can, with no user interaction and low complexity, add themselves to project teams and read restricted issues - a clear confidentiality breach (C:H) with minor integrity impact from the unauthorized team-membership change (I:L). The signals do NOT point to urgency: no EPSS score is provided, this is not on CISA KEV, and no public exploit code has been identified. The limiting factor is PR:L - an attacker needs a valid YouTrack account first, so this is an insider / lateral-movement / tenant-isolation-failure risk rather than a mass-internet exploitation risk. CWE-863 and the description describe an AUTHORIZATION failure; the 'Authentication Bypass' tag in the input is a mislabel and should not drive triage toward an unauthenticated-RCE posture.

An attacker who already holds a low-privilege YouTrack account (employee, contractor, external reporter, or compromised credential) invokes the project-team membership function to add their own account to a project they should not belong to, then opens issues restricted to that team and reads sensitive data (security reports, customer data, embargoed roadmap). No public proof-of-concept exists, but the low attack complexity and lack of required user interaction make the action trivial once authenticated.