JetBrains YouTrack CVE-2026-103494

Requires an already-authenticated YouTrack account with pre-existing elevated privileges (PR:H) and permission to influence user-group membership changes. Exploitation is further limited by AC:H: a specific group-configuration/membership state must exist for the escalation to succeed, so it is not reliably reproducible against arbitrary default deployments. No user interaction is needed (UI:N), and it is network-reachable (AV:N), but the privilege and configuration prerequisites sharply narrow the realistic attacker population to insiders or holders of a compromised privileged account on instances older than 2026.2.19422.

The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.6 Medium) describes a network-reachable but high-barrier flaw: PR:H means the attacker must already hold a privileged (though sub-admin) account, and AC:H signals that success depends on conditions outside the attacker's control (specific group-membership state/configuration). Given CWE-266 (Incorrect Privilege Assignment), the realistic impact is an already-authenticated privileged user escalating to broader rights via manipulation of user-group membership, after which full CIA is claimed. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the data - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H + PR:H plus the absence of EPSS/KEV/POC places this firmly in the 'genuine but low-urgency' tier rather than an emergency: it is a legitimate post-authentication privilege-escalation bug but not a mass-exploitable one. Note the full C:H/I:H/A:H impact rating is somewhat optimistic for a group-membership escalation and should be confirmed against JetBrains' advisory once detailed notes are published.

A malicious or compromised privileged (but non-admin) YouTrack user manipulates user-group membership assignments to grant their own account rights beyond those originally delegated. Once escalated, they can read restricted issues, alter project data, or disrupt availability. No public proof-of-concept exists, and the high attack complexity means the required group-configuration state must already be present.