JetBrains YouTrack CVE-2026-49385

Exploitation requires a valid YouTrack user account with at minimum low-privilege access (confirmed by CVSS PR:L). The attacker must be able to reach the YouTrack server over the network (CVSS AV:N). No special configuration, non-default feature, or specific deployment mode is required beyond standard YouTrack operation. Limiting factors: unauthenticated external attackers without a valid account cannot exploit this flaw; exploitation is bounded to the integrity of service account objects within YouTrack (S:U - no direct scope change to other systems from this CVE alone); and confidentiality is not directly impacted (C:N in the CVSS vector). The requirement for at least a low-privilege authenticated session is the primary realistic barrier to exploitation.

The CVSS 6.5 Medium score reflects network exploitability (AV:N), low attack complexity (AC:L), low-privilege requirement (PR:L), and high integrity impact (I:H) - a combination that represents meaningful real-world risk in any multi-user YouTrack deployment. The Scope:Unchanged (S:U) rating suggests impact is contained within YouTrack itself, though downstream systems relying on compromised service account credentials could be secondarily affected. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. No CISA KEV listing and no public POC have been identified at time of analysis, which tempers urgency slightly. However, the low privilege requirement means the attack surface includes every registered YouTrack user - not just administrators - making this a higher practical risk in environments with broad user bases or external user registration. The missing authorization class (CWE-862) is historically straightforward to exploit once discovered, as it typically requires only a crafted API call rather than complex memory corruption or chaining.

An authenticated low-privileged YouTrack user - such as a developer or reporter - sends a crafted API request to the service account management endpoint, bypassing the missing authorization check. The attacker modifies a service account's credentials or permissions, potentially rerouting integration tokens to attacker-controlled infrastructure or elevating the service account's access scope for subsequent abuse. No public POC is known, but the straightforward nature of CWE-862 (a missing server-side privilege check) means exploitation requires minimal technical sophistication once the vulnerable endpoint is identified.