JetBrains YouTrack EUVD-2026-72510

Exploitation requires a valid authenticated user account on the target YouTrack instance with at least low-privilege access (PR:L per CVSS). The attacker must have access to a whiteboard - in any project they can reach - that contains links referencing issues in a project or access scope they are not authorized to modify. The vulnerability is triggered by performing a standard whiteboard clone operation, a feature available to authenticated users by default. No elevated privileges, administrator access, non-default configuration, or victim interaction is required beyond the clone action itself. Only YouTrack versions before 2026.2.18634 are vulnerable; instances upgraded to 2026.2.18634 or later are not affected. The impact is limited to integrity - unauthorized link modifications on inaccessible issues - with no confidentiality disclosure or availability disruption from this path alone.

CVSS 7.7 with AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N is internally consistent and credible: any authenticated YouTrack user can reach the clone endpoint over the network with no special configuration, no elevated privileges, and no victim interaction, and the resulting unauthorized link writes cross security domain boundaries. The attack complexity is genuinely low - cloning a whiteboard is a standard user action. No EPSS data was supplied, and no KEV listing or public POC has been identified at time of analysis, suggesting opportunistic exploitation has not yet been observed. Despite these signals, even a mid-sized municipal IT team in swidnica relying on YouTrack's access controls to segregate sensitive project data should treat this as urgent, since the flaw structurally undermines the entire access-control model for issues - a security property that organizations depend on for confidential project separation. The vendor-confirmed patch (2026.2.18634) is available and there is no reported compensating workaround, making immediate upgrade the clear priority.

An authenticated YouTrack user with low-privilege access to a shared project identifies a whiteboard that references or links to issues residing in a restricted project they cannot normally read or write. The user clones that whiteboard using the standard clone UI action, triggering the server-side handler to write link associations to those restricted issues without authorization checks. The attacker can repeat this for any whiteboard containing links to sensitive issues, silently corrupting issue relationships across security boundaries.