JetBrains YouTrack versions prior to 2026.2.19656 allow a user who lacks update permission to alter the visibility settings of an issue. The vulnerability is a classic privilege escalation: by changing visibility, a malicious or careless user can expose hidden issues or conceal visible ones, thereby interfering with confidentiality and integrity of issue data. The weakness is identified as CWE-862, which refers to missing authorization checks.

The affected product is JetBrains YouTrack. All installations running a version older than 2026.2.19656 are potentially impacted, regardless of configuration, as the issue visibility change logic does not enforce update permission checks.

The CVSS score is 3.1, indicating low overall severity, primarily because the vulnerability does not grant direct code execution or denial of service. The EPSS score is not available, so the exploitation probability cannot be quantified, but the absence of a KEV listing suggests that publicly known exploitation has not yet occurred. The likely attack vector is the web interface or API where issuers can edit visibility; it does not require special privileges beyond existing user rights.