In prior releases of JetBrains YouTrack, a missing authorization check allowed any user to attach tags to any issue using the tag issues collection endpoint. This flaw enables unauthorized modification of issue metadata, potentially altering filtering, visibility, or assignment of issues. The vulnerability is a classic example of improper authorization.

JetBrains YouTrack is affected in all releases before 2026.2.19562, before 2026.1.14137, and before 2025.3.169041. Updating to any of these or newer patch versions removes the missing authorization flaw.

The CVSS score of 3.5 indicates a low severity impact, and there is no EPSS data or KEV listing for this issue. Because the flaw allows tag manipulation without special privileges, the primary risk is unauthorized metadata modification, which may affect issue tracking and reporting. The exploitation likelihood is moderate given the expected availability of the tag-update API, yet no public exploits are known at this time.