JetBrains YouTrack versions earlier than 2025.3.121962 allow applications to send requests to the app permissions endpoint without proper authorization. This flaw can enable an attacker who can influence or intercept app traffic to modify or expand application permissions, leading to privilege escalation within the YouTrack system or exposure of sensitive data. The weakness identified is a missing authorization control (CWE-862).

JetBrains YouTrack prior to version 2025.3.121962 is affected. Users must verify that their installations fall below this version number.

The vulnerability is rated high with a CVSS score of 8.8 and a very low EPSS score of less than 1 percent, indicating few publicly known exploitation efforts at this time. The CVE is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an internal or remote attacker able to send crafted HTTP requests to the permissions endpoint directly, possibly through a compromised application or an insider with access to the YouTrack API. The lack of authorization controls allows such requests to succeed, potentially granting elevated privileges or unauthorized data access.