JetBrains YouTrack EUVD-2026-90016

Exploitation requires the attacker to hold Project Administrator privileges within a YouTrack project (PR:H) and to use the notification template preview feature, which performs a missing authorization check when rendering referenced issues. No user interaction from a victim is needed (UI:N), and it is exploitable over the network against instances before 2026.2.19197. The primary limiting factor is that the attacker must already be a privileged, semi-trusted insider (Project Administrator); anonymous or ordinary low-privilege users cannot trigger it, which substantially narrows the realistic threat population.

This is a low-to-moderate priority issue that scores 4.9 (Medium) largely because it requires high privileges. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity authorization flaw that yields high confidentiality impact but zero integrity or availability impact - a pure information-disclosure bug. The critical limiter is PR:H: only a Project Administrator can trigger it, meaning the attacker is already a trusted, privileged user within a project rather than an anonymous outsider. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so exploitation status is: no public exploit identified at time of analysis. This contrasts sharply with the unauthenticated account-takeover sibling (CVE-2026-100277, CVSS 8.9); the present issue is a privileged-insider read primitive, not a mass-exploitation candidate. The C:H rating is defensible because restricted issues can contain sensitive data (credentials, security discussions), but the real-world risk is bounded by the need for an already-privileged, semi-trusted account, so this reads as a genuine defense-in-depth authorization fix rather than an urgent internet-facing threat.

A user holding Project Administrator rights in a JetBrains YouTrack instance opens the notification template preview feature, which fails to re-check whether the previewing user is authorized to view the referenced issues. The Project Administrator uses the preview to render and read the contents of issues that are otherwise restricted from them, disclosing sensitive issue data. No public proof-of-concept is available, and exploitation requires the attacker to already hold the elevated Project Administrator role.