This vulnerability (CWE-918) in JetBrains YouTrack allows SSRF attacks through the GitHub VCS integration in versions prior to 2026.2.19422. An attacker with high privileges can exploit this flaw to cause the server to perform unauthorized requests, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with high privileges can exploit this SSRF vulnerability to make the server send unauthorized requests, potentially accessing internal resources or services. The impact is limited to partial confidentiality and integrity loss, with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2026.2.19422, upgrading to version 2026.2.19422 or later is likely the intended remediation once officially released. Until then, restrict high-privilege access and carefully monitor the GitHub VCS integration usage.