A missing authorization check in JetBrains YouTrack’s notification template preview allows users with Project Administrator permissions to view restricted issues that should otherwise be hidden. This flaw elevates the role of the attacker within the project, exposing confidential issue information. The weakness is a classic example of insecure direct object references, identified as CWE‑639.

JetBrains YouTrack versions earlier than 2026.2.19197 are affected. The attack is possible for any user assigned the Project Administrator role on a project within those releases.

The CVSS score of 4.9 indicates a moderate severity impact; the EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is the notification template preview interface, and it requires the attacker to already possess Project Administrator privileges. Because the prerequisite role is not an arbitrary user account, the overall exploitability is limited to projects where Project Administrator access is granted, reducing the widespread risk but still exposing sensitive data to privileged users.