JetBrains YouTrack EUVD-2026-39654

Exploitation requires a valid YouTrack account (authenticated access, PR:L per CVSS vector) - unauthenticated external attackers cannot exploit this vulnerability. High attack complexity (AC:H) indicates that exploitation is not trivially repeatable and likely requires specific knowledge of how to craft MCP protocol requests targeting project settings endpoints. The vulnerable code path is specific to the MCP integration; deployments where MCP is not enabled or MCP endpoints are not reachable may not be exploitable in practice. The disclosed information is limited to project settings - not broader data such as issue content or user credentials. Exploitation is further constrained to projects where the attacker's account does not already hold settings-view permissions.

The NVD-assigned CVSS 3.1 base score is 3.1 (Low), reflecting a narrow impact profile: only confidentiality of project settings is affected (C:L), with no integrity or availability impact (I:N/A:N). The AV:N attack vector means exploitation occurs over the network, but AC:H (High complexity) significantly reduces real-world risk - exploitation is not straightforward and likely requires specific knowledge of MCP request crafting or non-default conditions. PR:L confirms that a valid authenticated account is a hard prerequisite, eliminating unauthenticated attack paths. No EPSS data was provided in source intelligence, and the vulnerability has not been added to the CISA KEV catalog. No publicly available POC exploit has been identified. The 'Authentication Bypass' tag may attract attention disproportionate to actual risk - defenders should note that this does NOT bypass authentication, only authorization for a specific settings-read path. Overall, this is a genuine but low-severity information disclosure issue that prioritizes internal threat modeling (insider or compromised account scenarios) rather than external attack surface reduction.

An authenticated YouTrack user with low project privileges sends a crafted request to the YouTrack MCP interface targeting a project for which they lack administrative or settings-view access. Because the MCP handler omits the authorization check (CWE-862), the server returns project settings data without enforcing project-level permissions. The attacker can then read configuration details that may expose internal workflow rules, integration tokens, or organizational project structure. No public exploit code has been identified.