JetBrains YouTrack users with read‑only permissions can alter issue visibility settings, exposing confidential information. The flaw is a missing authorization check during visibility modifications, classified as CWE-862. The attacker can change an issue’s visibility from public to private or vice versa, leading to unauthorized data disclosure and potential accidental data loss if visibility changes impact downstream processes.

JetBrains YouTrack versions prior to 2026.2.19562 are affected. Users of any earlier release with read‑only roles are at risk until the product is updated to the specified or newer version.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation evidence. The likely attack vector is an authenticated user accessing the web interface to trigger the visibility change. While the impact is limited to confidentiality, it could affect integrity if visibility changes trigger unintended workflows. The overall risk is moderate, with the primary concern being unauthorized information exposure.