JetBrains YouTrack CVE-2026-86490

Exploitation requires a valid authenticated YouTrack session with at least low-level user privileges (consistent with PR:L in the CVSS vector). The attacker must be able to reach the app import API endpoint over the network, which is standard in any internet-exposed or intranet YouTrack deployment. No special configuration, non-default feature enablement, or elevated role is required beyond a basic user account. Exploitation is constrained solely by the need for authenticated access; unauthenticated external parties cannot directly trigger the flaw without first obtaining credentials.

The provided CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately captures the network-reachable, low-complexity nature of the attack and its high integrity impact, while correctly noting no confidentiality or availability component in isolation. However, the Scope:Unchanged rating may practically understate downstream consequences: replacing a bundled YouTrack app with attacker-controlled code could serve as a foothold for subsequent confidentiality breaches or persistent access within the YouTrack environment, elevating real-world risk beyond the base score. No EPSS score was supplied, and no KEV listing confirms active exploitation, which moderates urgency somewhat. Even a mid-sized municipal IT team in leszno should treat this as urgent given that exploitation requires only a standard authenticated session - no admin role, no special configuration - and YouTrack instances routinely grant broad user access to developers, QA engineers, and project contributors. The absence of a known POC is a mitigating factor, but the low exploitation complexity (AC:L, PR:L) means this could be operationalized quickly once code is published.

An attacker with any valid YouTrack user account - such as a project member invited for issue tracking - submits a crafted HTTP request to the app import endpoint, naming a legitimate bundled app as the target and supplying a malicious application archive as the payload. The server's incomplete permission check accepts the request, replacing the bundled app with attacker-controlled code that executes within YouTrack's runtime context whenever the app is subsequently invoked by the platform or its users.