JetBrains YouTrack EUVD-2026-90008

Requires an authenticated user with administrative access to YouTrack's SMTP/notification configuration (PR:H) who can modify the SMTP server host setting; there is no unauthenticated or low-privilege path. Exploitation is limited to environments where SMTP credentials have actually been stored in YouTrack (i.e., outbound email/notifications are configured). No user interaction by a victim is needed. The core limiting factor is that the attacker must already hold operator-level trust, which sharply narrows realistic threat actors to insiders or attackers who have already compromised an admin account. Affects YouTrack versions before 2026.2.18991.

This is a low-risk, high-privilege information disclosure issue, not a real priority for most defenders. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.7) requires an already-authenticated administrator (PR:H) - the only role able to change the SMTP server host in YouTrack - so the attacker essentially must already be a trusted operator. Impact is confidentiality-only and rated Low: the leak is limited to stored SMTP credentials, not the full YouTrack data set. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent widespread exploitation. The signals are internally consistent (low CVSS aligns with the absence of exploitation intelligence); the main real-world risk is credential reuse - if the leaked SMTP account shares a password with other services, the blast radius could exceed the Low rating. Vendor-reported (JetBrains) with a patch available, which is the strongest available signal and points to a routine hardening fix rather than an urgent threat.

A malicious or compromised YouTrack administrator edits the notification/SMTP settings and repoints the SMTP server host to an attacker-controlled mail server; YouTrack then attempts to authenticate to that rogue server using its stored SMTP credentials, sending them to the attacker in cleartext. This is an authenticated (PR:H) exfiltration technique with no public exploit code identified at time of analysis; it requires no user interaction and no special client tooling beyond the normal admin UI.