JetBrains YouTrack CVE-2026-86491

Exploitation requires the attacker to already hold project-admin or organization-admin privileges in the YouTrack instance (CVSS PR:H), confining the realistic threat surface to insider scenarios or cases where an admin account has been previously compromised. A victim user must actively navigate to the project or organization page that renders the malicious icon (CVSS UI:R). No special network position, unauthenticated access, or non-default configuration is required beyond the admin-level privilege prerequisite. The combination of PR:H and UI:R substantially limits opportunistic or automated mass exploitation.

The vendor-assigned CVSS 3.1 score of 3.5 (Low) accurately reflects the realistic exploitation bar. PR:H constrains the attack to project or organization administrators - meaning a legitimate insider or a previously compromised admin account is required to plant the payload. UI:R further limits reach, requiring a victim to navigate to the page displaying the malicious icon. The S:U scope designation and C:L/I:L impact metrics indicate bounded blast radius: typical outcomes are partial session token exposure or localized UI manipulation rather than full account takeover or server compromise. No EPSS score was supplied in source intelligence, and no KEV listing or public exploit code exists, reinforcing low real-world urgency. This is better characterized as an insider-threat or post-compromise escalation primitive than an externally-driven exploitation risk.

A malicious project administrator uploads a crafted SVG file - with embedded JavaScript - as a project icon. When other users open the project overview page, their browsers execute the stored script, which can silently exfiltrate YouTrack session cookies or forge in-application requests on behalf of the victim. No public proof-of-concept code has been identified at time of analysis.