JetBrains YouTrack CVE-2026-62422

The core prerequisite named in the description is the 'direct database access' path that enables the authentication bypass to administrative access - the exact preconditions for reaching it (network-only versus some level of database or internal access) are not fully clear from the CVE text and should be confirmed against the JetBrains advisory. Limiting factors: the target must be a self-hosted YouTrack instance running a build below the listed fixed versions and be reachable by the attacker; the CVSS vector asserts no authentication and no user interaction (PR:N/UI:N), but this conflicts with the literal 'direct database access' wording, so defenders should verify whether prior database or internal-network access is actually required before assuming purely remote unauthenticated exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated attack yielding full confidentiality, integrity and availability impact with scope change - the highest-priority profile possible. However, the description phrase 'authentication bypass via direct database access' is in tension with PR:N/AV:N: taken literally, 'direct database access' could imply an attacker who already has some access to the backing database, which would raise real-world prerequisites well above 'unauthenticated over the network.' This ambiguity should be verified against the JetBrains advisory before treating it as trivially remote-exploitable. No EPSS score, KEV entry, SSVC decision, or POC was provided, so exploitation-probability signals are absent; the reliance on a vendor-assigned 10.0 with a self-reported finding (JetBrains) means the severity is confirmed by the vendor but breadth of exploitability is inferred. Net: treat as a high-priority patch due to admin-level impact, while explicitly confirming the exact preconditions with the vendor.

An attacker who can reach the YouTrack instance targets the unauthenticated code path implicated by the missing-authentication flaw and obtains administrative access to the tracker, then reads confidential project/issue data, tampers with tickets, and pivots into integrated source control or CI credentials stored or referenced in YouTrack. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means that once the technique is known, exploitation would require little sophistication.