JetBrains YouTrack CVE-2026-103491

Requires an authenticated YouTrack account with low privileges (PR:L) on an instance running a version before 2026.2.19422; the attacker then abuses the issue activities API, supplying the identifier of an issue in a project or queue they are not authorized to view. Exploitation is limited by the need for valid credentials and by its confidentiality-only impact (read access to restricted issue activity, no write or denial-of-service). No user interaction and no special non-default configuration are indicated - any instance that hosts restricted/permission-scoped issues alongside lower-privileged users is exposed.

This is a genuine but moderate-priority authorization flaw, not a high-CVSS-but-illusory issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent and credible: an IDOR in the issue activities API is network-reachable with low complexity, but requires an authenticated low-privilege account (PR:L), and the impact is confidentiality-only (C:H, I:N/A:N) - the attacker reads restricted issues they should not see but cannot modify or deny service. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The main data-quality conflict is the 'Authentication Bypass' tag, which contradicts the CWE-639 classification and the PR:L vector: this is a broken-access-control/IDOR issue against already-authenticated users, NOT an authentication bypass - treat the tag as mislabeled. Overall, real-world risk is moderate: trivial to exploit once a user has any YouTrack account, but gated behind authentication and limited to information disclosure.

An authenticated low-privilege YouTrack user (e.g., a member of one project) calls the issue activities API and substitutes the issue or activity identifier of an issue in a restricted project or security-limited queue. Because the endpoint authorizes insufficiently, the server returns the activity stream of the restricted issue, disclosing its contents to a user who lacks permission. No public exploit code was identified, but the attack requires only standard API calls with an enumerated or guessed issue ID.