JetBrains YouTrack CVE-2026-75047

Exploitation requires a valid YouTrack user account with at least low-privilege access (PR:L per CVSS vector), meaning fully anonymous exploitation is not possible. The attacker must be able to reach the YouTrack import endpoint over the network (AV:N). No user interaction by a victim or administrator is required beyond the attacker's own submission. Exploitation is limited by the authentication requirement: guest or unauthenticated access to YouTrack must not be enabled for the attack surface to remain at PR:L. Environments with public registration or large numbers of untrusted authenticated users face proportionally higher risk.

The CVSS 3.1 score of 6.5 (Medium) is well-calibrated for this vulnerability. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates network-accessible exploitation with low attack complexity but requiring authenticated access (PR:L), which is the primary limiting factor. Any registered YouTrack user - including those with minimal permissions - can trigger the condition, making the attack surface broader than admin-only flaws but still narrower than unauthenticated ones. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting no observed mass exploitation. The 'Information Disclosure' tag in the source data conflicts with the vulnerability description and CVSS impact (A:H, C:N, I:N) - this appears to be a metadata tagging error and should not influence risk decisions. Real-world priority is moderate: environments with untrusted or numerous authenticated users (e.g., self-hosted instances open to contractors or external teams) face higher risk than tightly controlled internal instances.

An attacker with a valid YouTrack account - even a low-privilege one - crafts a decompression bomb archive (e.g., a deeply nested zip with repetitive data achieving a 1000:1 or greater compression ratio) and submits it to the import endpoint. The server begins decompressing the file, rapidly exhausting available memory or CPU, causing YouTrack to become unresponsive or crash and denying service to all other users. No public proof-of-concept has been identified, but decompression bomb construction is well-documented and trivial.