JetBrains YouTrack CVE-2026-75051

Exploitation requires the attacker to hold a valid authenticated session in the YouTrack instance - confirmed by the CVSS vector PR:L (low-privileged user). The attack is network-accessible (AV:N) with no special conditions or elevated permissions needed beyond basic user authentication. The vulnerability specifically manifests in multi-organization YouTrack deployments where project transfer functionality is available; single-organization instances may have reduced exposure since there is no alternate organization to transfer into, but this is a deployment-topology limitation, not a security control. No user interaction from the project owner or an administrator is required (UI:N). Limiting factors include: the requirement for at least a valid YouTrack user account (unauthenticated external attackers are excluded), and the need for the target project to be reachable in some form by the attacker's session (exact visibility requirements not specified in the advisory).

The CVSS 8.1 score reflects genuine, actionable risk: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction needed (UI:N), with high confidentiality and integrity impact (C:H/I:H) and no availability impact (A:N). The combination of PR:L and AC:L means any registered user in a YouTrack instance - including those with minimal permissions - can attempt this operation with no special preparation. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal. There is no CISA KEV listing and no POC availability noted, which moderately reduces urgency compared to a KEV-listed or publicly weaponized flaw. However, the low attack complexity means EPSS is likely non-trivial even absent public exploits. For multi-organization or multi-tenant YouTrack deployments, this is a genuine priority - a rogue or compromised internal user can exfiltrate entire project histories, issues, and associated sensitive data by transferring projects to an attacker-controlled organization. Single-organization deployments may have a reduced blast radius but are not immune if the instance is shared across teams.

An authenticated low-privileged YouTrack user with access to a shared or multi-organization instance identifies a target project belonging to another organization. The attacker submits a project transfer request to the API without holding the required authorization over the target project; due to the missing authorization check, the server processes the request and transfers the project - along with all its issues, attachments, and metadata - into the attacker's organization, granting full access to the project's data. No public exploit code has been identified at time of analysis, but the straightforward nature of the flaw means any developer-level attacker can discover and replicate it through routine API interaction.