JetBrains YouTrack CVE-2026-86500

The attacker must be an authenticated YouTrack user who has been explicitly granted 'project update' permissions on at least one project in the target instance. Unauthenticated users and users with read-only or no project access cannot exploit this vulnerability. The issue is scoped to the project-level privilege boundary; exploitation does not by itself grant instance-wide administrative access. No special network position, non-default configuration, or tooling is required beyond holding the project update role and making a crafted API or UI request.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N yields a 5.5 (Medium) score. The S:C component captures the privilege boundary crossing - the user moves from a scoped project role into an administrative one - and is a meaningful signal. However, PR:H as specified by the vendor may slightly overstate the barrier: a 'project update' credential is arguably a low-to-moderate privilege level, not full system-admin access. Independently assessed, PR:L is more representative of the attacker's actual starting position, which is a standard project contributor. No EPSS score was provided, and the absence of both a KEV listing and a public POC means this is not a known-weaponized issue. The realistic threat comes from insider risk: contractors, external collaborators, or compromised project-member accounts. Even a mid-sized municipal IT team in tczew should treat this as a routine patching cycle priority rather than an emergency, given that exploitation requires holding an existing, non-trivial project-level credential. Organizations with strict separation between project contributors and project admins - or those running YouTrack exposed to external collaborators - carry higher residual risk.

An authenticated YouTrack user - such as an external contractor or a compromised project member account holding 'project update' rights - crafts or replays a role-assignment request to confer Project Admin status on their own account. Because the escalation check is absent, the application accepts the request without further authorization validation, elevating the attacker's permissions within the project. With Project Admin access, the attacker can then modify project membership, access restricted issue data, alter workflows, and potentially pivot to broader administrative actions depending on YouTrack instance configuration.