In JetBrains YouTrack versions before 2025.3.170763, 2026.1.14150, and 2026.2.19656, the application performed improper URL validation within the app widget host. This flaw allowed malicious or compromised app widgets to send arbitrary REST requests to the YouTrack instance without requiring user confirmation. The vulnerability presents an access‑control issue (CWE‑862) that can enable unauthorized operations, potentially breaching confidentiality, integrity, and availability by manipulating data or settings through the REST API.

The affected product is JetBrains YouTrack. Versions prior to 2025.3.170763, 2026.1.14150, and 2026.2.19656 are vulnerable. The flaw exists in the app widget host component that manages third‑party widgets interacting with the YouTrack REST API.

The CVSS score of 8.4 reflects a high severity. As the EPSS score is not available, the exact likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious app widget or compromise a trusted widget in order to use the flaw; an attacker with such a widget could issue REST calls without user confirmation, potentially escalating privileges or modifying data. Due to the lack of publicly available exploit patterns, exploitation would likely target users who enable third‑party widgets or depend on the widget host for integrations.