The weakness in JetBrains YouTrack allows a project administrator whose project is marked as related to another project to delete VCS integrations that belong to the other project, violating expected resource isolation. This is an example of improper authorization (CWE‑863). The eliminated integration can break build pipelines, disrupt continuous delivery, and expose repository configuration to tampering, thereby compromising the integrity and availability of the affected project.

JetBrains YouTrack versions earlier than 2026.2.19562 are impacted. Having administrator rights over a related project provides the capability to exploit the flaw.

The vulnerability carries a moderate CVSS of 3.8 and no EPSS score is provided; it is not listed in the CISA KEV catalog. The flaw requires only project administrator privileges, so an internal actor with that role can exploit it without any remote or additional access. Although the risk is moderate, the lack of a large‑scale exploitation record does not negate the need for prompt remediation.