JetBrains YouTrack EUVD-2026-60243

Exploitation requires a valid authenticated session in JetBrains YouTrack with at minimum low-privilege access (PR:L per CVSS vector) - no administrative or elevated role is needed. The attacker must be able to reach the YouTrack mailbox endpoint over the network (AV:N). No user interaction beyond the attacker's own requests is required (UI:N), and no special non-default configuration or feature flag is described as a prerequisite. Limiting factors include the authentication requirement - unauthenticated external attackers cannot exploit this directly - and the need for network reachability to the YouTrack instance. Organizations that restrict YouTrack access to internal networks or VPN significantly reduce exposure. The flaw is specific to the mailbox endpoint, not the general YouTrack API surface.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 8.1 (High), reflecting a low-friction, network-accessible attack requiring only valid credentials - no special roles, no user interaction, and no complex preconditions. The dual High impacts on integrity and availability are consistent with unrestricted entity deletion. EPSS data was not provided in the input, so exploitation probability cannot be quantified. This CVE is not listed in CISA KEV, and no public POC has been identified, suggesting the vulnerability has not yet been widely exploited. Despite the absence of active exploitation signals, even a mid-sized municipal IT team in tczew should treat this as urgent given that any employee with a YouTrack login could systematically destroy project data. The tags note 'Authentication Bypass,' which is slightly misleading - authentication is enforced, but authorization is bypassed; the distinction matters for defenders scoping mitigations.

An authenticated YouTrack user with a basic account discovers or enumerates entity IDs through normal application browsing, then crafts HTTP DELETE requests targeting the mailbox endpoint for entities they do not own. Because the endpoint lacks authorization checks, the server processes each deletion without verifying ownership or permissions, allowing the attacker to destroy issues, projects, or other entities across the platform. No public POC has been identified, but the attack requires only valid credentials and is otherwise straightforward to construct from standard HTTP tooling.