The vulnerability resides in JetBrains YouTrack versions prior to 2026.1.13570, where an authorization flaw permits authenticated low‑privileged users to alter service account settings. This abuse can change account permissions, potentially elevating their influence over system operations, and compromising confidentiality, integrity, and availability of the platform. The weakness corresponds to CWE‑862.

Affected systems are installations of JetBrains YouTrack running any version earlier than 2026.1.13570. The issue has been identified by the JetBrains CNA and pertains exclusively to that product line.

With a CVSS base score of 6.5, the vulnerability presents a moderate severity risk. The EPSS score is not available, and the flaw is not currently catalogued in the CISA KEV list. Attacks would require an authenticated session; a low‑privileged user could leverage the exposed interface to modify service accounts, implying that the attack vector is likely authenticated over the web application. The absence of a publicly available exploit does not eliminate the risk, especially in environments where low‑privileged accounts have broad privileges.