JetBrains YouTrack CVE-2026-86482

Requires an authenticated YouTrack account at any privilege level (PR:L per CVSS vector); guest or read-only accounts are sufficient if they have login access. No special configuration, non-default feature, or specific platform is required - the flaw exists in the core group membership change workflow present in all YouTrack deployments before 2026.2.18634. Exploitation is bounded by having any valid credential; unauthenticated attackers cannot trigger this directly. Network access to the YouTrack web interface (HTTP/HTTPS) is required (AV:N). There is no user interaction dependency (UI:N), meaning no privileged user needs to be deceived or tricked into approving the change.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, low-complexity privilege escalation requiring only a valid low-privilege account - even a mid-sized municipal IT team in walbrzych running an on-premises YouTrack instance should treat this as urgent given that any developer or guest user account becomes a foothold for full administrative takeover. No public exploit code is known and this CVE is not listed in the CISA KEV catalog, which tempers immediate exploitation pressure but does not reduce the structural risk: group-membership manipulation is straightforward to attempt once the endpoint is identified. EPSS data is absent from the input, but the low attack complexity and widespread deployment of YouTrack in developer organizations suggest meaningful real-world risk. The absence of UI:N and AC:L requirements means automation is entirely feasible once an attacker holds any valid credential.

An attacker with a low-privilege YouTrack account - such as a developer granted read-only project access - submits a crafted API or web request to the group membership endpoint, supplying a target group with administrative privileges. Because the server does not validate whether the requesting user is authorized to assign that group, the membership change succeeds, and the attacker's account is promoted to administrator. No public exploit code is known at time of analysis, but the low attack complexity makes manual reproduction straightforward.