Technical impact
JetBrains YouTrack prior to version 2025.3.161254 and 2026.1.14042 contains an improper authentication flaw that permits an attacker to perform an account takeover without requiring legitimate credentials. By submitting a request that self‑asserts a target's email address, the attacker can claim the account and obtain all of its privileges. The vulnerability is identified as CWE‑290 and enables the attacker to read, modify, delete, or otherwise manipulate the victim's data and system resources.
Affected Systems
Affected vendors include JetBrains. The product YouTrack is impacted in all releases before 2025.3.161254 and before 2026.1.14042. No other versions or sub‑products are listed as vulnerable.
Risk and Exploitability
The CVSS v3 score of 9.8 signals critical severity, and the exploitability is high because no authentication is required. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of EPSS does not diminish the risk due to the nature of the flaw. Attackers can reach the vulnerable endpoint through the publicly accessible Helpdesk interface, making it likely that exploitation could occur over the Internet.
