In JetBrains YouTrack versions prior to 2026.2.16593, the default role configuration exposes excessive user profile details. This allows a user with the default role to view more personal information than intended, leading to privacy violations. The weakness is classified as CWE‑276, Insecure Permissions.

The vulnerability affects JetBrains YouTrack. All releases before 2026.2.16593 inherit this flaw, as the issue originates from the default role settings bundled with the product.

The CVSS base score of 4.3 indicates moderate impact. EPSS is not available and the flaw is not listed in CISA KEV, suggesting limited, if any, known exploit activity. The likely attack vector involves authenticating to the application and accessing the role configuration or user profiles; no special privilege escalation is required beyond the default role. Organizations not using the default role or that have already patched are not affected.