The vulnerability is in the processing of mail rules in JetBrains YouTrack. A project administrator can create rules that trigger cross-project issue commands, bypassing project boundaries and allowing manipulation of issues in other projects. This grants unauthorized authority over issues the administrator normally cannot control, undermining the integrity of project data and potentially exposing confidential information. The weakness is a missing authorization flaw (CWE-862).

JetBrains YouTrack installations running any release older than 2026.2.19575, 2026.3.16075, 2026.3.16397, or 2026.3.16402 are susceptible. The fix is provided in later releases, so selecting any version newer than the listed vulnerable releases will mitigate the problem.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is <1%, indicating low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attacks require an authenticated project administrator who can create or modify mail rules; using this capability an attacker can execute arbitrary issue commands across projects, compromising data integrity but not allowing arbitrary code execution or system takeover.