The vulnerability allows any project administrator in JetBrains YouTrack versions prior to 2026.2.19197 to read comments from projects that they do not normally have access to. By exploiting notification templates, an attacker can retrieve sensitive discussion content, exposing confidential project information. This is an authorization bypass that results in a confidentiality compromise.

JetBrains YouTrack. All installations running a version earlier than 2026.2.19197 are affected, as project administrators can read cross‑project comments. Versions 2026.2.19197 and later are not vulnerable.

The CVSS score of 7.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. The attack requires only project administrator credentials, which are typically possessed by legitimate administrators; once available, the attacker can configure notification templates to expose cross‑project comments without additional privileges.