JetBrains YouTrack hosts a comment templates endpoint that, in versions prior to 2026.2.16593, does not enforce proper authorization checks. This inadequate authorization allows any user who can reach the endpoint to read private data associated with other users. The flaw is an example of CWE‑862, where access control is insufficient, and a successful exploitation results in a breach of confidentiality, exposing sensitive user information that was expected to remain private.

The affected product is JetBrains YouTrack. All releases before 2026.2.16593 are vulnerable; users of those older versions should verify if they are impacted. No other products or vendors are listed as affected.

The CVSS score of 4.3 indicates a moderate severity when considering impact, but the lack of an EPSS score and KEV listing suggests that widespread exploitation has not been observed yet. The vulnerability is reachable via the web API; an attacker would need network access to the YouTrack server or a compromised client session to hit the comment templates endpoint. Because the flaw allows data disclosure without requiring elevated privileges, the risk is primarily to privacy and confidentiality, rather than to system integrity or availability.