JetBrains YouTrack EUVD-2026-90019

Exploitation requires an attacker with privileges to create or modify YouTrack workflows (per PR:H, effectively project-administrator access) to store the XSS payload in a workflow error notification toast. It further requires victim interaction (UI:R): a user must trigger the workflow error condition so the poisoned toast renders in their browser. Limiting factors: high privilege prerequisite makes this primarily an insider or post-compromise escalation vector rather than a remote-anonymous exploit; the payload only fires along a workflow error path and only affects sessions of users who encounter that toast. Not exploitable against default configurations without a privileged actor and a triggering victim.

The CVSS 3.1 base score of 6.9 (vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) is dominated by the scope change (S:C) and high confidentiality impact (C:H) typical of an XSS payload that executes in a victim's authenticated browser session. Real-world risk is meaningfully constrained by two factors: PR:H means the attacker must already hold high privileges - in YouTrack, workflow scripts are authored/edited by project administrators, so this is not an anonymous-attacker primitive - and UI:R means a victim must trigger the poisoned workflow so the malicious error-notification toast renders. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding was vendor-reported (JetBrains) and quietly patched rather than surfacing through in-the-wild activity. The C:H rating is somewhat aggressive for a toast-based XSS - it presumes session/token theft leading to account compromise; typical stored XSS is more often scored C:L/I:L, so treat the 6.9 as an upper-bound estimate. Overall this is a low-to-medium operational priority: a privileged-insider or post-compromise escalation vector in a niche server component, patched and lacking any exploitation signal.

A user with workflow-editing privileges (project admin) crafts a YouTrack workflow whose error path emits a notification toast containing a stored XSS payload. When another user - potentially a higher-privileged admin - performs an action that triggers the workflow error, the toast renders and the script executes in that victim's authenticated session (S:C), enabling session/token theft or actions on their behalf. No public exploit code is identified at time of analysis.