The flaw in JetBrains YouTrack allows an attacker to bypass the Authorized Reporters list for a helpdesk project. As a result, any authenticated user could create or modify reports in that project without being explicitly granted permission. This missing access control enables unauthorized disclosure of support information, potential tampering with support tickets, and disruption of helpdesk processes.

All installations of JetBrains YouTrack with versions earlier than 2026.2.19197 are affected. The vulnerability is present only in the helpdesk project feature and does not impact other YouTrack features.

The CVSS score of 4.3 signifies a moderate severity. No EPSS data is available, and the strain is not listed in the CISA KEV catalog, suggesting limited or no known exploitation. The attack surface likely involves the web interface of YouTrack, requiring that the user has basic authentication to the platform. While the vulnerability is not trivial, it remains a concern if unpatched users rely on the helpdesk project for sensitive support data.