JetBrains YouTrack CVE-2026-86498

Exploitation requires an authenticated YouTrack user account with at least minimal access (PR:L); completely unauthenticated exploitation is not possible. The attacker must have network access to the YouTrack instance (AV:N). No special configuration or non-default deployment mode is required-the flaw exists in standard YouTrack REST API link handling. The limiting factors are: (1) the attacker must hold a valid YouTrack account, and (2) the targeted linked entity must be in a project or scope the attacker can reference by ID but lacks update permission on. Exploitation does not require user interaction (UI:N) and is not conditional on any optional feature being enabled.

The CVSS 7.7 rating with AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N accurately characterizes a realistic threat: any authenticated YouTrack user-including low-privilege reporters or commenters-can tamper with issue links across project boundaries. The scope change elevates impact because the authorization bypass reaches beyond the attacker's own project or permission set. No EPSS score is available in the provided data, and there is no KEV listing or public POC, which dampens immediate urgency; however, the attack complexity is low and requires only a valid account, making it straightforward for any insider or compromised credential holder to exploit. For organizations that use YouTrack to track sensitive development work or integrate it with CI/CD pipelines, unauthorized modification of issue links can corrupt traceability, release planning, and compliance audit trails-even a mid-sized municipal IT team in swidnica should treat this as urgent if YouTrack is used to manage change requests or approval workflows. The absence of confidentiality impact means data exfiltration is not a concern, but integrity damage to linked work items is meaningful in regulated environments.

An authenticated YouTrack user with read-only access to a restricted project crafts a PUT request targeting a link sub-resource of an issue in that project, specifying a new linked entity. Because the API does not verify update permission on the target entity, the modification succeeds-allowing the attacker to alter issue dependencies, parent-child relationships, or cross-project links without authorization. No exploit code is publicly available, but the technique requires only knowledge of the REST API endpoint structure and a valid session token.