JetBrains YouTrack CVE-2026-103496

Requires an authenticated low-privilege YouTrack account (PR:L) on an instance running a version before 2026.2.19422, with the inbox/notifications feature in use. Exploitation is remote over the network (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N): the attacker directly references inbox thread/notification identifiers that lack a per-user ownership check. The limiting factor is the authentication requirement - this is not exploitable by fully unauthenticated outsiders - and impact is confined to disclosure of other users' notification contents rather than modification or service disruption.

This is a moderate, authenticated information-disclosure flaw that reads as a genuine-but-low-urgency issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4) indicates a network-reachable, low-complexity IDOR requiring an existing authenticated low-privilege account, with only low confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. One internal inconsistency: the description describes purely READING other users' notifications, which maps cleanly to a confidentiality impact (C:L), yet the vendor vector also asserts I:L (integrity) - the description gives no basis for an integrity effect, so the I:L is questionable and should be verified with JetBrains. Overall the signals are consistent in pointing to a real but low-priority bug: exploitation is gated behind valid authentication and yields limited cross-user notification data, not account takeover or RCE.

An attacker who already holds a valid low-privilege YouTrack account manipulates the identifier for an inbox thread or notification in an API/UI request, causing the server to return notifications belonging to other users instead of the attacker's own. Because the reference lacks any object-ownership check (IDOR/CWE-639), the attacker can enumerate identifiers to harvest other users' inbox notifications, which may contain issue details, mentions, or workflow information. No public proof-of-concept is available, and exploitation requires authentication but no user interaction and only low attack complexity.