JetBrains YouTrack EUVD-2026-33378

Exploitation targets the fetchApp request handling in YouTrack instances running any build before 2026.1.13162; the specific prerequisite is network reachability of the YouTrack server's fetchApp endpoint. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - exploitation works against reachable default installations. The primary limiting factor is exposure: instances restricted to internal networks, VPNs, or IP allowlists sharply reduce the attacker population, and only YouTrack builds prior to 2026.1.13162 are affected. Note that CISA SSVC rates technical impact as only 'partial', implying the information obtainable may be bounded rather than a complete data compromise.

The signals here are mixed and lean toward lower real-world priority despite the 7.5 (High) CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) describes an easily reachable, unauthenticated, network-exploitable confidentiality breach, which raises the base score. However, corroborating exploitation signals are all weak: EPSS is 0.00% (0th percentile), the vulnerability is not in CISA KEV, and CISA SSVC scoring rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The SSVC 'partial' technical impact contrasts with the CVSS C:H rating, suggesting the disclosed information may be scoped or limited rather than a full data compromise - this discrepancy is worth verifying against the vendor advisory. No public proof-of-concept has surfaced, and the disclosure originated from JetBrains itself rather than external exploitation reports. Overall this is a legitimate confidentiality bug that should be patched, but current evidence indicates it is not under active or imminent mass exploitation.

An attacker with network access to a YouTrack instance sends a crafted fetchApp request to the server and receives back sensitive information that should not have been exposed, without needing valid credentials or tricking any user. Because attack complexity is low and no authentication is required, the request can be issued directly against any internet-reachable instance. No public proof-of-concept is known at this time.