In JetBrains YouTrack, editors could alter the visibility of restricted child articles because the system failed to enforce proper authorization checks. This missing authorization (CWE‑862) permits a user with editor rights to expose content that should remain hidden, thereby compromising the confidentiality of protected information.

The vulnerability affects JetBrains YouTrack installations running any version prior to 2026.2.19197. The affected product is JetBrains YouTrack and the issue is limited to those versions released before the specified patch.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely via the web interface using a legitimate editor account; no remote code execution or elevated privilege beyond editor rights is required.