JetBrains YouTrack CVE-2026-86487

Exploitation requires the attacker to hold a valid YouTrack user account with at minimum read-only permission on the target whiteboard - unauthenticated users cannot exploit this. The whiteboard feature must be in use on the YouTrack instance (it may not be enabled or utilized in all deployments). High attack complexity (AC:H) reflects the need to craft a correctly structured WebSocket message that bypasses the authorization check, which requires knowledge of the WebSocket protocol format used by YouTrack's whiteboard. There is no user interaction required once the attacker has a valid session. Exploitation is bounded to the whiteboard canvas of boards the attacker can already view.

The overall risk is low. The CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) correctly reflects the limited blast radius: exploitation requires an existing authenticated account with at least read-only whiteboard access (PR:L), high attack complexity to craft the correct WebSocket payload (AC:H), and yields only limited integrity impact (I:L - whiteboard canvas content modification). There is no confidentiality or availability impact. No EPSS data, no CISA KEV listing, and no public exploit code are present in the input, placing this squarely in the 'monitor and patch on schedule' category rather than emergency remediation. The practical harm is confined to unauthorized defacement or corruption of whiteboard content within the scope of a single YouTrack board, which is a low-stakes business impact for most organizations.

An attacker holding a YouTrack account that has been granted read-only access to a specific whiteboard constructs a WebSocket message that mimics a legitimate write/canvas-mutation operation. By sending this crafted message, the attacker's modification is accepted by the server without authorization checks, allowing them to alter, corrupt, or overwrite whiteboard content. No public exploit code was identified at time of analysis.