JetBrains YouTrack CVE-2026-86497

Exploitation requires an account with project administrator privileges in YouTrack - this is an elevated role, not a standard user. The attacker must have access to the mailbox configuration UI for at least one project that has an email integration configured with stored credentials. The vulnerability does not affect projects with no mailbox integration. The missing control is the absence of re-authentication (password confirmation) before the mailbox host field is saved; without that gate the stored credentials are relayed passively. Exploitation is limited to the credentials of the specific mailbox(es) configured per project, not all YouTrack users' credentials.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) scores 6.8 Medium, which is accurate given the PR:H prerequisite - exploitation requires project administrator privileges, meaningfully constraining the attack surface. The S:C (scope change) and C:H reflect that credentials exfiltrated to an external server constitute an out-of-scope confidentiality breach. No EPSS data is provided, and there is no KEV listing or known public exploit, so real-world exploitation risk appears low without additional privilege compromise. The primary concern is insider threat or account takeover of a project admin account used as a pivot to harvest mail credentials. Organizations running on-premise YouTrack with sensitive mailbox integrations face higher residual risk than cloud-hosted users if JetBrains has already patched the hosted service.

A malicious or compromised project administrator logs into YouTrack, navigates to the mailbox integration settings for a project, and changes the SMTP/IMAP host to an attacker-controlled server without being prompted to re-enter their own credentials. When YouTrack next attempts to connect to send or receive mail, it presents the stored mailbox username and password to the attacker's server, completing credential exfiltration in a single low-complexity step.