The flaw allows users with low-level Admin Read permissions to retrieve integration credentials from import configurations. These credentials can be used to access external services integrated with JetBrains YouTrack, exposing sensitive data without enabling code execution or impacting system availability. The vulnerability is classified as CWE-863, insufficient authorization.

JetBrains YouTrack versions earlier than 2026.2.19197 are impacted. Users of 2026.2.19197 or newer are not affected by this issue.

The CVSS score of 3.3 indicates low severity, and the EPSS score is not available, with no listing in CISA KEV. Exploitation requires an account that already holds low-level Admin Read permission, making the threat an internal risk. The attacker would obtain exposed integration credentials, potentially compromising confidentiality of connected services. The likely attack vector is an authorized user who leverages the privileged read access to discover import configuration data.