JetBrains YouTrack EUVD-2026-72504

Exploitation requires a valid authenticated YouTrack user session, confirmed by the CVSS PR:L metric - unauthenticated attackers cannot exploit this flaw. The attacker must have network access to the YouTrack API (AV:N), which in typical deployments means access to the web application. No elevated roles or administrative privileges are needed; any regular project member account suffices. No special server-side configuration is required - the vulnerability is present in the default endpoint behavior of all YouTrack installations prior to 2026.2.18634. Exploitation is strictly read-only (I:N, A:N): attackers can only retrieve private saved search data, not modify or delete it.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects a medium-severity network-reachable flaw requiring only low-privilege authentication (PR:L), consistent with the collaborative nature of YouTrack where many project contributors hold valid accounts. The confidentiality impact is rated High (C:H) because private saved searches may encode sensitive security queries, internal project filters, or business-critical logic that users explicitly chose not to share - making this more than trivial information leakage. No EPSS data was provided in the input, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. Conversely, the attack technique is mechanically straightforward for any authenticated user familiar with the YouTrack API, requiring no exploit tooling. Even a mid-sized municipal IT team in mielec should treat this as urgent if their YouTrack instance hosts security-sensitive saved searches or separation-of-concern project structures where user privacy is expected. The absence of integrity and availability impact (I:N, A:N) limits the blast radius to information disclosure, but on shared or multi-tenant instances the exposure across all user accounts is potentially broad.

An authenticated YouTrack user with a low-privilege account submits API requests to the watchRules or issueListConfig endpoints, substituting their own valid object IDs with IDs belonging to other users. By iterating through sequential or guessable identifiers, the attacker retrieves private saved searches that other users configured, potentially exposing sensitive security-related queries, internal project filters, or confidential business logic. No public proof-of-concept has been identified, but the technique requires only standard API knowledge and no specialized tooling.