The vulnerability arises from an improper authorization check in the YouTrack application configurations endpoint. When accessed, the endpoint allows an authenticated user to change project settings without sufficient privilege validation. This flaw enables an attacker to modify configuration parameters such as project permissions, workflow rules, and issue categorization, potentially altering the behavior of projects and affecting multiple users in the organization. The weakness corresponds to CWE-862.

JetBrains YouTrack installations with versions earlier than 2026.2.16593 are affected. Any instance that has not upgraded to a version released on or after 2026.2.16593 remains vulnerable.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, so the overall exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting that there is no confirmed widespread exploitation. Attackers would need an authenticated session, and the likely attack vector is remote HTTP access to the configurations API. Once authenticated, the lack of proper authorization allows the attacker to alter project settings across the instance.