JetBrains YouTrack CVE-2026-86489

Exploitation requires a valid authenticated session in the YouTrack instance (PR:L per CVSS vector) - any registered user qualifies. No special roles, administrative access, or non-default configuration is needed beyond having an account. The flaw is present in default YouTrack deployments. Cross-organization data exposure occurs when the instance hosts multiple organizations (a common enterprise and SaaS configuration). The limiting factor is that unauthenticated external attackers cannot exploit this; a valid user account on the target instance is the minimum prerequisite.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately captures the risk profile: network-reachable, trivially exploitable by any authenticated user, with no integrity or availability consequence but full confidentiality loss against private issue content and starred folders. EPSS data was not provided; however, the low attack complexity and broad authentication baseline (any registered user) suggest moderate real-world exploitation probability. No KEV listing and no public POC are identified at time of analysis, which tempers urgency somewhat. The cross-organization boundary break is the highest-risk element - in a SaaS-style or shared-instance deployment, a low-trust user in one organization could exfiltrate confidential project data from another. The scope metric (S:U) is accurate since the compromise is confined to the application's own data store rather than affecting the underlying host.

An authenticated YouTrack user with a standard low-privilege account in Organization A iterates through user profile API identifiers - sequentially or via enumeration - and retrieves private issue details and starred folder contents belonging to users in Organization B. No public exploit code is identified, but the attack requires only an HTTP client and a valid session cookie, making it trivially constructable from the API's normal behavior.