JetBrains YouTrack CVE-2026-86493

Exploitation requires a valid YouTrack user account assigned a read-only role - this is the minimum authentication level needed to reach the whiteboard card API. No administrative privileges, special network position, or non-default configuration is needed beyond authenticated access. The bypass is limited to the whiteboard card feature; it does not extend to issue creation, code review, or administrative functions. Exploitation is bounded to the scope of projects the read-only user has been granted visibility into.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5 (Medium), which is plausible. Attack vector is network, complexity is low, but PR:L confirms that a valid YouTrack account with at least read-only access is required - unauthenticated exploitation is not possible. Integrity impact is rated High, reflecting that write operations on whiteboard cards are meaningfully unauthorized, though the blast radius is bounded to the whiteboard feature rather than affecting core issue data, source repositories, or authentication infrastructure. No KEV listing and no disclosed POC indicate this has not been weaponized at scale. The risk is real but limited to insider-threat scenarios or compromised read-only accounts in multi-tenant YouTrack deployments. There are no conflicting signals in the available data.

An attacker with a legitimate but unprivileged (read-only) YouTrack account - such as a contractor, auditor, or compromised low-trust user - sends a card creation or modification API request to the whiteboard endpoint. The server's authorization check incorrectly permits the write operation without verifying that the caller's role prohibits it. The attacker can create, edit, or delete whiteboard cards in projects they should only be able to view, potentially disrupting sprint planning data or injecting misleading task information. No public POC exists at time of analysis.