JetBrains YouTrack installations prior to version 2026.2.16593 contain an improper access control flaw that permits users to view saved queries and tags that they should not be allowed to read. This weakness falls under Access Control Weakness (CWE-862) and can expose sensitive project metadata or configuration details, compromising confidentiality. The vulnerability does not lead to code execution or denial of service, but it enables an actor with legitimate credentials or session to glean information that may assist in further attacks or internal data exposure.

The flaw affects JetBrains YouTrack across all platforms. Any instance running a version earlier than 2026.2.16593 is potentially vulnerable. Users should verify the exact runtime version and apply updates where necessary.

The CVSS score is 4.3, indicating a moderate severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog, so exploitation likelihood is considered low to moderate. The likely attack vector involves an authenticated user who requires common access rights that the system incorrectly grants; therefore, an internal or compromised account can exploit the flaw. Given the moderate CVSS and lack of public exploitation evidence, the overall risk remains moderate, but any environment handling sensitive project data should still prioritize remediation.