JetBrains YouTrack EUVD-2026-72494

Requires that the YouTrack Helpdesk feature is enabled and network-reachable by the attacker, and that the attacker knows or guesses the email address of an existing target account to assert. No authentication, no credentials, and no user interaction are needed (PR:N/UI:N), and default configurations with Helpdesk active are exploitable. Limiting factors: instances without Helpdesk enabled, or those not reachable from the attacker's network (VPN/internal-only deployments), are not exposed; the takeover is bound to accounts whose email can be asserted via Helpdesk.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and full compromise of the targeted account (confidentiality, integrity, availability of that account's data). This is a genuine high-priority issue rather than an inflated CVSS score, because the impact verb - account takeover - is directly stated and the prerequisites are minimal. Any organization running an internet-exposed self-managed YouTrack with Helpdesk enabled should treat this as urgent and patch immediately, and even a mid-sized municipal IT team in kielce operating a small on-prem instance faces the same unauthenticated exposure. Tempering factors: no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation yet - the risk is currently potential rather than confirmed in-the-wild. The 'account takeover' impact is scoped to accounts reachable via Helpdesk email association; a full instance-admin takeover is plausible if an admin's email can be asserted but is not explicitly confirmed by the source.

An attacker locates an internet-reachable YouTrack instance with Helpdesk enabled and interacts with the Helpdesk intake using a target user's email address as a self-asserted identity. Because the email is trusted without verification, the attacker is authenticated as that user and gains access to the victim's account, tickets, and associated data. No public POC was provided, but the low-complexity, no-authentication nature makes exploitation straightforward once the endpoint is identified.