JetBrains YouTrack EUVD-2026-39657

Exploitation requires an active, authenticated YouTrack session with at least low-level privileges (PR:L per CVSS vector). The attacker must possess a valid YouTrack account - unauthenticated access is not sufficient. The vulnerability specifically targets the saved queries and tags feature; only instances where other users or projects have created saved queries or tags with restricted access present meaningful data exposure. Factors limiting exploitation include: the requirement for a valid user credential, the low sensitivity of the exposed data type (queries and tags rather than issue content or credentials), and the absence of any integrity or availability impact. There is no indication that a non-default configuration is required - any authenticated YouTrack user on a vulnerable build may trigger the issue.

The CVSS 3.1 score of 4.3 (Medium) reflects the limited blast radius: AV:N means the vulnerability is remotely reachable, AC:L indicates no special conditions, but PR:L confirms authentication is required, and the impact is confined to confidentiality at a low level (C:L/I:N/A:N). Real-world risk is moderate-to-low: an attacker must already hold a valid YouTrack account, and the data exposed (saved queries and tags) is ancillary rather than core sensitive data such as source code or credentials. However, saved queries may encode sensitive project structure or internal naming conventions, and tags may reveal confidential issue categorizations. No EPSS data was provided in the source intelligence; with no KEV listing and no known POC, opportunistic mass exploitation is unlikely. This is a genuine access boundary violation but not a critical-priority item for most organizations unless YouTrack instances are exposed to untrusted authenticated users (e.g., contractor or customer portals).

An authenticated YouTrack user with minimal privileges - such as a contractor or a user with read-only project access - crafts a request to the YouTrack API endpoint responsible for listing saved queries or tags. Due to the missing authorization check, the server returns saved queries or tags belonging to other users or restricted projects, potentially revealing sensitive issue filters, internal project naming conventions, or confidential tag taxonomies. No public exploit code has been identified at the time of this analysis.