A flaw in JetBrains YouTrack allows an attacker to alter the visibility settings of articles regardless of update permissions. This can lead to inadvertent exposure of sensitive information or denial of legitimate access, creating a moderate integrity and availability impact on the application’s document repository. The weakness is a classic instance of insufficient authorization controls, identified as CWE-288.

JetBrains YouTrack installations running any version before 2026.2.18991 are vulnerable. Users who can access the article visibility configuration interface without having update privileges may exploit this issue.

With a CVSS score of 5.4 the vulnerability is considered moderate; the EPSS score is not available and it is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface, where an authenticated actor with lesser privileges can manipulate visibility settings. Because no privilege escalation beyond account existence is required, the impact is limited to the scope of the user’s existing access rights.