JetBrains YouTrack EUVD-2026-33377

Exploitation requires an active authenticated session with at least low-level privileges in YouTrack (confirmed by PR:L in the CVSS vector). The attacker must be able to reach the YouTrack web interface over the network (AV:N, AC:L). The specific pages involved are the Users and Groups administrative sections of the application - the vulnerability is scoped to these endpoints and does not appear to affect other parts of the application. No user interaction from another party is required (UI:N). What limits exploitation: the attacker must hold a valid YouTrack account; unauthenticated external parties cannot exploit this flaw. The impact is confined to read-only disclosure of user and group metadata - no write access, privilege escalation, or remote code execution is possible through this vulnerability alone.

The CVSS 4.3 Medium score reflects a realistic but bounded impact: the attack vector is network (AV:N), complexity is low (AC:L), privileges required are low (PR:L), no user interaction is needed (UI:N), and the scope is unchanged (S:U) with only confidentiality impact at a low level (C:L/I:N/A:N). This means any authenticated user - including those with minimal permissions such as a basic project member - can potentially exploit this flaw over the network with no further prerequisites. However, the impact is limited to information disclosure; no integrity or availability risk is present. No EPSS score was provided in the input data, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation. The tag 'Authentication Bypass' in the source data is potentially misleading: the CVSS vector confirms PR:L (low privilege required), meaning exploitation is not truly unauthenticated - the bypass is of authorization checks within an already-authenticated session, not of the authentication mechanism itself. Real-world priority should be moderate: the flaw is easy to exploit for any account holder but yields only organizational metadata rather than credentials or code execution.

An authenticated YouTrack user with a standard low-privilege project member account navigates directly to the Users and Groups administrative pages. Due to the incorrect authorization check, the server returns user account metadata and group membership details that the user's role should not permit them to see, enabling enumeration of the organization's internal structure, active accounts, and team groupings. No special tooling or exploit code is required - the disclosure is triggered through normal browser navigation.