A missing authorization check in JetBrains YouTrack allows a user with a Project Admin role to manage VCS hosting server configurations. This flaw is an access‑control weakness (CWE‑862) that permits an authenticated user to alter settings that normally require higher privileges, potentially exposing repository access credentials or redirecting traffic. The impact is therefore privilege escalation within the YouTrack instance.

The vulnerability affects JetBrains YouTrack installations running versions prior to 2026.2.19562. Users deploying any earlier release are potentially exposed.

The CVSS score of 4.7 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the web interface, exploiting the missing check when a Project Admin user accesses the VCS hosting configuration pages. Mitigation requires applying the update; until then, the risk persists only for internal users with Project Admin permissions.