JetBrains YouTrack CVE-2026-86496

Exploitation requires a valid YouTrack account with at least low-level privileges (PR:L per CVSS vector) - anonymous or unauthenticated access is not sufficient. The Helpdesk feature with configured authorized reporters must be in active use on the target instance; organizations that do not use the Helpdesk reporter functionality are not exposed. The vulnerability is network-accessible (AV:N) with no complexity barrier (AC:L) and no user interaction requirement beyond the attacker holding a legitimate account. Exploitation is limited to read-only access to email addresses; no write or destructive capability is exposed.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects this as a low-severity information disclosure requiring a valid low-privileged account; the impact is confined to confidentiality of email addresses with no integrity or availability consequence. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at the time of writing. Real-world risk is bounded by the requirement for a pre-existing authenticated account on the YouTrack instance, but for organizations relying on YouTrack Helpdesk to handle external customer or partner submissions, leaking reporter email addresses could facilitate targeted phishing campaigns or violate data-protection obligations - even a mid-sized IT team managing a YouTrack deployment in legnica would need to assess whether exposed reporter emails fall under GDPR or equivalent privacy obligations. Priority should be moderate: patch promptly but this does not warrant emergency response outside regulated environments.

An authenticated low-privileged YouTrack user - such as a developer or contractor with a standard account - queries the Helpdesk authorized reporters endpoint without holding the necessary administrative role. The missing authorization check returns the full list of reporter email addresses, allowing the attacker to harvest external contact details for downstream phishing or account-enumeration purposes. No public exploit code is identified at time of analysis, but the attack requires only standard HTTP requests.