JetBrains YouTrack EUVD-2026-60245

Exploitation requires a valid authenticated session on the JetBrains YouTrack instance; any user account with low-level credentials is sufficient, and no administrative privileges are needed. The vulnerable surface is specifically the users search endpoint, which processes queries without verifying whether the requesting user is authorized to enumerate accounts beyond their own scope. No special configuration, non-default deployment mode, or specific platform version is required beyond running a YouTrack release prior to 2026.2.18112. Exploitation is limited by the authentication prerequisite: unauthenticated external actors cannot directly exploit this vulnerability without first obtaining valid credentials through another vector. The impact is strictly confined to confidentiality of account identifiers; no integrity or availability impact is possible through this endpoint.

The CVSS 3.1 score of 4.3 (Medium) accurately characterizes the limited blast radius: confidentiality impact is low (account identifiers only), integrity and availability are unaffected, and the prerequisite of a valid authenticated session substantially narrows the attack surface. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Real-world risk is primarily an insider-threat and privilege-escalation-precursor concern - even a mid-sized IT team in kalisz managing a YouTrack deployment should treat this as a meaningful internal exposure, since a compromised low-privilege account could silently harvest the full user roster for downstream phishing or credential-stuffing campaigns. The 'Authentication Bypass' tag in the source data is misleading and should not inflate perceived severity; this does not enable unauthenticated access. Overall, this is a genuine low-to-medium severity finding that warrants timely patching but does not require emergency incident response.

An attacker who holds any valid YouTrack account - including a newly registered or minimally privileged one - authenticates to the instance and sends iterative queries to the users search endpoint, extracting the full roster of registered account identities. The harvested usernames and email addresses are then used to craft targeted spear-phishing campaigns or to perform credential-stuffing attacks against associated corporate services. No public exploit code has been identified, though the technique requires no specialized tooling beyond a standard HTTP client.