JetBrains YouTrack CVE-2026-75049

Exploitation requires a valid YouTrack user account at any privilege level - no administrative or elevated role is needed. The attacker must be able to authenticate to the YouTrack instance and must know or enumerate article IDs belonging to projects outside their authorized scope. The vulnerable code path is specifically the draft creation endpoint, which improperly discloses the content of referenced articles without checking project membership. Limiting factors: unauthenticated external attackers cannot exploit this directly; the impact is strictly read-only (no write or availability impact); and exploitation effectiveness depends on the sensitivity of content stored in restricted YouTrack articles. Non-default article restriction settings are required - if no articles have project-level access restrictions applied, there is no confidential content to disclose.

The provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is well-calibrated: network-accessible with low attack complexity, but gated behind valid authentication (PR:L), producing a 6.5 Medium score that reflects the real-world risk accurately. The confidentiality impact is rated High because restricted articles may contain sensitive project documentation, internal credentials, architectural designs, or proprietary business information - a complete bypass of project-level access controls. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC has been reported. The primary threat actor profile is a malicious or compromised low-privilege insider who enumerates article IDs to exfiltrate cross-project sensitive content. The absence of integrity and availability impact limits blast radius, but the confidentiality exposure alone warrants prompt patching in environments where YouTrack articles hold sensitive information.

An authenticated YouTrack user with access limited to a single low-sensitivity project sends a crafted POST request to the draft creation endpoint, referencing the numeric ID of an article belonging to a restricted project they do not have authorization to view. The endpoint processes the request and returns the full article body without enforcing project-level read permissions, exposing confidential documentation to the caller. No public exploit code exists, but the technique requires only knowledge of the YouTrack REST API and the ability to enumerate or guess article IDs.