JetBrains YouTrack versions prior to 2026.2.19197 allow users with restricted permissions to edit and hide other users’ comments. This flaw enables such users to alter or conceal comment content, thereby violating the integrity and, in some cases, the confidentiality of project communication. The weakness is an improper authorization (CWE‑863) that permits privilege escalation within the application’s comment handling features.

Affected vendor and product: JetBrains YouTrack. All installations of YouTrack running a version older than 2026.2.19197 are impacted; no specific sub‑components are singled out.

The CVSS score of 4.9 classifies the vulnerability as moderate. EPSS information is unavailable, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation is documented. Based on the description, it is inferred that attackers can exploit this issue by utilizing legitimate user credentials that already belong to a restricted role; no special conditions such as network access or elevated privileges are required beyond those granted to the compromised account.