Youtrack EUVD-2026-23386

Requires valid credentials for a high-privileged YouTrack user account with administrative permissions (PR:H in CVSS vector). The specific administrative privilege needed is access to features that process template expressions-most likely workflow rule editing, custom field configuration, issue template management, or similar administrative configuration interfaces where template engines are employed. Exploitation is possible against default YouTrack configurations once administrative access is obtained. The low attack complexity (AC:L) indicates that no additional security mechanisms (beyond the authentication requirement) protect against this sandbox escape. Limiting factors: organizations with strict administrative access controls, multi-factor authentication enforcement for admin accounts, and segregation of duties (where workflow configuration rights are separated from full system admin) reduce the pool of accounts that can exploit this vulnerability.

Real-world risk is moderate despite the 7.2 CVSS score. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H shows network accessibility with low attack complexity but critically requires high privileges (PR:H), meaning only users with administrative or equivalent access can exploit this. SSVC analysis confirms exploitation status is 'none' (no active exploitation), 'not automatable' (requires privileged access), but 'total technical impact' (full system compromise). EPSS score of 0.00% (0th percentile) indicates extremely low predicted exploitation probability in the wild. The authentication bypass tag appears to refer to bypassing the sandbox security boundary rather than application authentication itself. Primary risk scenarios are malicious insiders with admin rights or environments where admin credentials have been compromised through separate attack vectors (phishing, credential stuffing). For organizations with strong admin access controls and audit logging, this represents lower practical risk than the CVSS score suggests. However, in multi-tenant SaaS environments or installations with broad admin role assignment, the impact could be severe as it enables lateral movement from application compromise to underlying infrastructure.

An attacker who has compromised an administrative account (through credential theft, social engineering, or prior system compromise) authenticates to the YouTrack web interface. They navigate to workflow customization, custom field configuration, or issue template editing features and inject malicious template directives that escape the security sandbox. The crafted payload executes arbitrary code in the context of the YouTrack server process, granting the attacker complete control over the YouTrack instance and potential access to the underlying operating system, database credentials, and connected systems.