CVE-2026-111092: CWE-862 in JetBrains YouTrack

This vulnerability in JetBrains YouTrack involves improper authorization (CWE-862) where mail rules permit a project administrator to execute issue commands across different projects. This could lead to unauthorized modification of issues in projects outside the administrator's scope. The affected versions are those prior to 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

An attacker with project administrator privileges can execute commands on issues in other projects, potentially leading to unauthorized information disclosure and modification of issue data across projects. There is no impact on system availability. This could compromise confidentiality and integrity of issue tracking data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided in the available data. Users should monitor JetBrains advisories for official fixes and apply updates once available. Until then, restrict project administrator privileges to trusted users only.