JetBrains YouTrack includes a flaw that permits users who have permission to create sprints to move issues from projects that are normally inaccessible. In doing so, the attacker can read or modify issues in protected projects, elevating their privileges. This weakness is a privilege escalation issue identified as CWE-863, and it can compromise the confidentiality and integrity of issue data.

Any JetBrains YouTrack instance running a version released before the security fix is affected. The specific release that contains the remediation is not disclosed, so all older releases should be assumed vulnerable.

The CVSS score is 3.8, indicating low to medium severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV. The likely attack vector involves the web‑based sprint creation interface; an attacker would need sufficient permissions to create a sprint within the application.