JetBrains YouTrack includes a saved‑query endpoint that, before version 2026.2.19562, lacks proper authorization checks. When accessed, this endpoint returns full issue descriptions, allowing a user without the necessary permissions to read sensitive data. The flaw is a missing authorization vulnerability (CWE‑862) that can lead to the disclosure of confidential project or customer information.

The affected product is JetBrains YouTrack. All installations running a version earlier than 2026.2.19562 are vulnerable. No other vendors or products are affected according to the CNA data.

The CVSS score of 7.5 reflects a moderate‑to‑high severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Due to the lack of an authorization guard on a web‑exposed endpoint, it is likely that a threat actor can exploit the flaw remotely from any system that can reach the YouTrack server. Based on the description, it is inferred that the attack does not require special credentials and can be performed by an unauthenticated or low‑privilege user.