JetBrains YouTrack EUVD-2026-33394

The attacker must hold a valid authenticated session on the target YouTrack instance with at least low-privilege access (PR:L per CVSS vector). The vulnerability is specifically exercised through the Planning Canvas feature - exploitation requires interaction with this component, not general YouTrack API access. Exploitation is limited by: (1) the mandatory requirement for a valid authenticated account on the instance, ruling out unauthenticated external attackers; (2) impact is scoped to confidentiality only - restricted write or administrative actions are not achievable via this flaw; and (3) only instances hosting restricted issues or articles on Planning Canvas present meaningful data exposure risk.

The CVSS 6.5 score is derived from vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network-exploitable, low-complexity, low-privilege authentication required, with high confidentiality impact but no integrity or availability impact. The PR:L requirement meaningfully constrains opportunistic exploitation - an attacker must first obtain a valid YouTrack account, reducing the exposed attack surface to insiders, compromised accounts, or users with self-registration access. No EPSS score was provided in available data, and the absence of a KEV listing and public POC suggests no evidence of active exploitation at this time. Despite the high confidentiality CVSS sub-score, real-world prioritization should be moderate: the primary risk is unauthorized disclosure of sensitive project data such as security roadmaps, unreleased features, or internal communications stored in restricted issues. Organizations with sensitive projects on shared YouTrack instances should treat this as a higher priority.

An authenticated low-privileged YouTrack user - such as a contractor or guest account - accesses the Planning Canvas and systematically manipulates issue or article identifier parameters in HTTP requests to retrieve restricted items from projects they have not been explicitly granted access to. Because attack complexity is low and no user interaction is required, this enumeration could be scripted to extract metadata or content from restricted security or roadmap issues across the entire instance.