JetBrains YouTrack CVE-2026-111092

Exploitation requires an authenticated account with project-administrator privileges on a YouTrack instance, and requires use of the mail rules feature to issue cross-project issue commands. The limiting factors are significant: the attacker must already hold project-admin rights (PR:H) and the instance must process mail rules, so impact is confined to environments where project administration is delegated to users who should not have cross-project access (e.g., multi-team or multi-tenant deployments). It is not remotely exploitable by unauthenticated or low-privileged users, and there is no indication of required victim user interaction beyond normal mail-rule processing.

This is a moderate, privilege-gated authorization flaw (CWE-862, Missing Authorization) rather than a high-urgency internet-facing threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) is internally consistent with the description: exploitation requires PR:H - a project administrator account - so the attacker is already a trusted, authenticated insider, which substantially limits the real-world population of potential actors and caps the score despite HIGH confidentiality and integrity impact. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The dominant signal is that this is an insider/privilege-boundary violation (a project admin crossing into other projects' issues via mail rules), not a remotely weaponizable unauthenticated bug - making it a lower operational priority than the 6.5 score alone might suggest, though still relevant in multi-tenant YouTrack instances where project-level admin is delegated to semi-trusted users. Note the input 'Authentication Bypass' tag conflicts with the CWE-862 classification and the PR:H requirement: this is an authorization/privilege-boundary issue, not an authentication bypass - verify tagging.

A user who holds project-administrator rights on one YouTrack project crafts or configures a mail rule whose issue commands are applied to issues in other projects they are not authorized to manage. When the rule processes incoming mail, YouTrack executes the cross-project commands, letting the admin read or modify issues outside their authorized scope. No public exploit code is known, and exploitation requires an existing authenticated project-admin account.