JetBrains YouTrack CVE-2026-86499

Exploitation requires an active, authenticated YouTrack account - the CVSS PR:L metric confirms this. The vulnerability is triggered through the predefined search fields feature; any authenticated user who can access this feature is able to enumerate group names. No special role, administrative privilege, or non-default configuration is required beyond basic login access. Limiting factors: authentication is mandatory (unauthenticated exploitation is not possible), only group names are disclosed (not membership lists, credentials, or issue data), and the impact is bounded to confidentiality of organizational structure. YouTrack instances with a small or fully trusted user base have near-zero practical risk.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a low-severity authenticated information disclosure. Real-world risk is limited: exploitation requires an active YouTrack account (PR:L), the exposed data is restricted to group names - not group memberships, credentials, or issue content - and the vulnerability is confined to a single product feature. No KEV listing and no public proof-of-concept reduce urgency further. EPSS data is not provided, but given the authenticated requirement and narrow impact scope, opportunistic mass exploitation is implausible. The primary risk is reconnaissance: an insider or compromised low-privilege account could map out the organizational group structure to inform privilege-escalation or social-engineering attacks. The tag 'Authentication Bypass' in the input metadata is a mislabel - attackers must authenticate; this is an authorization (not authentication) flaw.

An authenticated YouTrack user with a low-privilege account queries predefined search fields and observes all group names returned in the response, including groups configured with restricted visibility. The attacker uses the enumerated group list to identify high-value teams (e.g., 'Security-Ops', 'Finance-Leads') and targets members of those groups with spear-phishing or attempts to escalate privileges toward those groups. No public exploit code is required; standard YouTrack UI or API access suffices.