The vulnerability is a missing authorization check in the TeamCity integration of JetBrains YouTrack, allowing users with access to the integration to view actions performed on projects that they should not have permission to see. This flaw, categorized as CWE-639, compromises confidentiality by exposing sensitive operational details across project boundaries.

JetBrains YouTrack installations with a version earlier than 2026.2.19562 are affected. Users of YouTrack who have enabled or have access to its TeamCity integration are at risk.

The CVSS score of 5.4 indicates an average severity. EPSS data is unavailable, and the vulnerability is not listed in KEV, suggesting it has not yet been widely exploited or reported as a known exploit. Attackers would need to leverage the TeamCity integration—typically requiring a user with integration permissions—to access unintended project data. The exploit is likely limited to environments where TeamCity integration is enabled and accessible.