JetBrains YouTrack versions before 2026.2.19656 contain an application permission bypass that allows a user to elevate privileges when interacting with the project tab. The bypass is a classic example of a privilege escalation flaw classified as CWE‑863, where incorrect enforcement of access controls permits unauthorized actions. When exploited, an attacker can acquire higher rights within the YouTrack instance, potentially accessing or modifying all project data, configuration settings, and user information.

The vulnerable component is JetBrains YouTrack any deployment prior to the 2026.2.19656 release. Organizations running earlier versions of the product are susceptible, regardless of the operating environment, as the flaw exists in the core web application.

The CVSS score of 6.4 indicates a medium criticality level. The EPSS score is not available, suggesting limited current exploitation data, and the vulnerability is not listed in the CISA KEV catalog. Although the official description does not specify the exact attacker model, it is inferred that the flaw can be triggered via the web interface, likely requiring a logged‑in user with any project view rights. A remote attacker who gains access to the project tab can potentially exploit the permission bypass to execute privileged actions without additional system compromise.