JetBrains YouTrack EUVD-2026-90002

Requires a valid authenticated YouTrack account at read-only privilege level (PR:L); the flaw is the absence of an authorization check that should prevent such users from reading project settings. Exploitation is limited by that authentication requirement - a completely unauthenticated outsider cannot trigger it - and impact is bounded to disclosure of project settings only (no write access, no broader data). Applies to YouTrack instances running versions before 2026.2.18991.

This is a genuinely low-priority information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only limited confidentiality impact and no integrity or availability effect - a read-only user seeing project settings they should not, i.e. a broken-authorization/over-exposure defect (CWE-201). No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. Nothing here elevates the issue beyond its modest CVSS: it requires an existing authenticated account, yields only partial disclosure of configuration/settings data, and has no path to code execution or data modification. This is a low-CVSS, low-real-risk item best handled through normal patch cadence, not emergency remediation.

An attacker who already holds a legitimate low-privilege (read-only) YouTrack account browses or calls an endpoint that returns project settings which should be restricted to project admins, obtaining configuration details they are not authorized to view. No public exploit code is available, and because the flaw grants only read access to settings, it is most useful for reconnaissance or as one step in a broader insider/escalation effort rather than as a standalone breach.