JetBrains YouTrack versions before 2026.2.19197 allow users with the guest role to delete a workflow action’s visibility restriction and execute that action. This flaw lets unauthorized users run any configured action as though they had full privileges, potentially causing unintended changes or operations within the system. The weakness corresponds to CWE-863 – Inappropriate Authorization.

All installations of JetBrains YouTrack running a version older than 2026.2.19197 are affected. Only the prior releases before this build hold the bug; newer releases include the fix, as indicated on JetBrains’ security issue tracker.

The CVSS score of 5.9 marks this vulnerability as moderate, indicating a release‑level risk despite no documented public exploits or listing in the CISA KEV catalog. The lack of an EPSS score and public evidence suggests that exploitation is not currently widespread, yet guest users who can authenticate to the system are a viable vector. The flaw can be exploited by an attacker who gains guest access, removes the visibility rule, and triggers the action, potentially escalating privileges or executing unintended workflows. Prompt remediation is recommended to mitigate the possibility of privilege escalation in environments that expose guest accounts or lack strict role controls.