The vulnerability is a missing authorization check in JetBrains YouTrack versions earlier than 2026.2.18991. It allows users with read‑only access to view project settings, exposing configuration information that should be restricted. This flaw does not provide code execution or modify data, but it does reveal potentially sensitive project configuration details.

System administrators should verify that any JetBrains YouTrack deployment running a version prior to 2026.2.18991 is affected. The issue is specific to the JetBrains YouTrack product, with the affected range covering all releases before 2026.2.18991. No other JetBrains products are listed as impacted.

The CVSS score of 4.3 indicates a medium‑risk severity, and the EPSS score is not available, so the overall exploitation likelihood is uncertain. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an authenticated read‑only user within the application; a malicious or compromised read‑only account could leverage the flaw to inspect project settings and potentially gather information useful for further attacks.