JetBrains YouTrack EUVD-2026-39656

Exploitation requires a valid authenticated account on the YouTrack instance, as confirmed by PR:L in the CVSS vector. The vulnerable condition is the default role configuration present in all YouTrack versions before 2026.2.16593, which grants excessive read access to user profile data without any administrator action required to introduce the exposure. Instances where administrators have manually restricted default role permissions prior to this fix may not be exploitable in practice. The attack is fully network-accessible with low complexity and requires no user interaction. Limiting factors: valid credentials are required (no unauthenticated path per PR:L), and impact is confined to reading user profile details - no code execution, data modification, or service disruption is possible through this vulnerability alone.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the limited but real impact: network-accessible (AV:N), low attack complexity (AC:L), requiring only low-privilege authentication (PR:L), no user interaction (UI:N), no scope change (S:U), and constrained to low confidentiality impact (C:L) with no integrity or availability consequence (I:N/A:N). No EPSS score is present in the input data, so exploitation probability cannot be quantified. KEV status is absent - confirmed active exploitation is not established. No POC is referenced. In multi-tenant or enterprise YouTrack deployments where user privacy is regulated or organizationally sensitive, the risk is meaningful: internal users could enumerate colleague profile details (potentially email addresses, roles, organizational data) beyond their intended access. However, the absence of integrity or availability impact, the authentication prerequisite, and the lack of any known exploit all place this firmly in a genuine-but-limited information disclosure category rather than a critical operational risk.

An authenticated YouTrack user with a standard low-privilege account navigates to the user directory or profile lookup functionality and retrieves profile attributes for other users - such as email addresses, full names, or organizational metadata - that should be restricted by role. Because the default role configuration ships with excessive read permissions, no privilege escalation or special tooling is required beyond a valid login session. No public exploit code is known to exist.