JetBrains YouTrack EUVD-2026-60249

Exploitation requires a valid authenticated session on the YouTrack instance (PR:L per CVSS vector) - any low-privilege account such as a standard developer or reporter is sufficient. The attack is conducted over the network without requiring physical or local access. The crafted input must target the type parameter processing pathway; the specific API endpoint or feature accepting these parameters is not identified in the available data. No user interaction from another party is required. Limiting factors: authentication is mandatory, meaning external unauthenticated attackers cannot exploit this directly; an attacker must first obtain or compromise a YouTrack account. Self-hosted deployments not exposed to the public internet have a reduced attack surface.

The CVSS 3.1 base score of 7.1 reflects high availability impact (A:H) paired with low confidentiality impact (C:L) and no integrity impact, with a network attack vector and low complexity - meaning any authenticated user can reliably trigger the condition. EPSS data is not provided, limiting probabilistic exploitation forecasting. KEV status is absent and no POC has been identified, which tempers urgency somewhat; however, the low attack complexity and low privilege requirement mean this is trivially reproducible once the request pattern is known. Even a mid-sized municipal IT team in ustka - were they running a self-hosted YouTrack instance - would find this significant if developers rely on YouTrack for daily operations, since a sustained DoS could halt issue tracking and release workflows entirely. The C:L component in the vector is noteworthy and may reflect incidental information exposure during error conditions, though this is not elaborated in the description.

An authenticated YouTrack user - including a low-privileged developer or reporter account - sends a sequence of API requests containing specially crafted type parameters designed to trigger excessive resource allocation on the server. The server processes these without throttling, leading to CPU or memory exhaustion and rendering YouTrack unavailable to all users. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent rediscovery straightforward.