JetBrains YouTrack EUVD-2026-90588

Requires an attacker with privileges sufficient to create or modify a GitHub VCS integration in YouTrack (project/administrative-level access, matching PR:H) on an instance running a version before 2026.2.19422. The GitHub VCS integration feature must be in use/available. There is no user-interaction requirement, but the high privilege prerequisite is the primary limiting factor - this is not exploitable by anonymous or low-privileged users against a default configuration; it is a capability available only to trusted operators of the instance.

This is a moderate-severity, low-real-world-priority issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N = 5.5 MEDIUM) is the only quantitative signal provided; there is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis. The single most important mitigating factor is PR:H: exploitation requires high privileges, because an attacker must be able to configure a GitHub VCS integration - an administrative/project-admin function in YouTrack - rather than attack an anonymous endpoint. The S:C (scope change) and SSRF nature mean a successful request can pivot to reach internal-only services behind the YouTrack server, but confidentiality and integrity impact are rated Low and availability impact is None, consistent with a read/limited-write SSRF rather than full internal compromise. No conflicting signals are present (network vector matches a server-side integration feature). Overall: a legitimate flaw worth patching during normal maintenance cycles, but not an emergency - the privilege requirement sharply limits the attacker population, and no evidence of exploitation exists.

An attacker who already holds privileged access to a YouTrack instance (able to create or edit a GitHub VCS integration) configures the integration to point at an attacker-chosen or internal URL, causing the YouTrack server to issue requests to that target. This lets the attacker probe or reach internal network services that are otherwise unreachable from outside, leveraging the server's trusted network position. No public proof-of-concept is available at time of analysis, and the required high privilege level makes this a post-access escalation/pivot technique rather than an opportunistic remote attack.