JetBrains YouTrack CVE-2026-103495

Requires a valid authenticated YouTrack account (PR:L) on an instance running a version before 2026.2.19422; the attacker must be able to reach the translation-catalog reload function. Exploitation is limited by the need for prior authentication and by the minimal impact - only an unauthorized catalog reload (availability), with no data read or modification. No user interaction or special non-default configuration is indicated.

This is a low-real-risk issue despite the network attack vector. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) scores 4.3 and describes an authenticated (PR:L) missing-authorization flaw whose only impact is low availability (A:L) - no confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a low-privilege authenticated user can invoke a function (reloading translation catalogs) they should not be authorized to call, likely causing minor, transient operational disruption rather than system compromise. The only tension is the 'Authentication Bypass' tag, which conflicts with both the CWE-862 (missing authorization) classification and the PR:L vector - this is an authorization flaw abusable by an already-authenticated user, not an authentication bypass. Priority is low: it is a defense-in-depth authorization hardening fix, not an urgent threat.

An authenticated low-privilege YouTrack user sends a request to the administrative endpoint that reloads translation catalogs, an action that should be restricted to administrators. Because the authorization check is missing, the server performs the reload, consuming resources and potentially causing brief service degradation. No public exploit code is known, and the impact is limited to availability.