JetBrains YouTrack CVE-2026-86481

Exploitation requires an active authenticated YouTrack user account (PR:L per CVSS). The attacker must be able to obtain or observe a signed URL for a project icon, which is possible if they have legitimate access to any project on the same YouTrack instance. The bypassed control is project-level icon visibility for restricted or private projects. Limiting factors: no unauthenticated exploitation path exists; the disclosed information is limited to graphical icon assets, not issue content, attachments, comments, or credentials; and the flaw is instance-scoped - an attacker outside the instance cannot exploit it without first obtaining credentials.

Real-world risk is low. The CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately captures the constrained impact: exploitation requires authenticated access (PR:L), and the disclosed resource is limited to project icons - graphical assets - rather than issue content, source code, or credentials. EPSS data is not provided; no KEV listing or POC code exists, consistent with the narrow scope of impact. SSVC-style assessment suggests low exploitation urgency: the technical impact is partial confidentiality loss of non-sensitive metadata, exploitation is not automatable at scale, and the attack surface requires a valid user account. The 'Authentication Bypass' tag in the input is a mislabel - this is an authorization bypass (IDOR via signed URL reuse), not an authentication bypass; the attacker must already hold a valid session. Defenders can prioritize this as a routine patch cycle item rather than emergency response.

An authenticated YouTrack user with access to at least one project obtains a signed URL for a project icon from their permitted project context. They then substitute or replay that URL to retrieve the icon of a restricted project they are not authorized to view, bypassing the project's access controls. No public exploit code exists, and the impact is limited to icon asset disclosure rather than sensitive project data.