The vulnerability allows users with only view permissions to edit Gantt charts, enabling unauthorized modifications to project schedules and related data. This violates expected access controls, allowing a lower‑privileged user to alter information that should be protected, thereby compromising data integrity.

JetBrains YouTrack instances running versions released before 2026.2.18991 are affected. Administrators should confirm whether their deployment uses a prior release and plan an upgrade accordingly.

The CVSS score of 4.3 indicates moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited publicly known exploits. An attacker would need to possess a view‑only account on a vulnerable YouTrack instance, which is a legitimate user role; thus the attack surface is internal or from compromised credentials. The discrepancy between view and edit roles should be remediated promptly to prevent unintentional data alteration.