This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects JetBrains YouTrack versions prior to 2026.1.13570. It allows users with limited privileges to bypass access controls and enumerate issues and articles that should be restricted within the Planning Canvas feature. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in high confidentiality impact without integrity or availability impact. No patch or official remediation level has been published by JetBrains as of the data provided.

Successful exploitation could lead to unauthorized information disclosure by enumerating restricted issues and articles, potentially exposing sensitive project data. There is no indication of impact on data integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Planning Canvas feature to trusted users only and monitor for unusual access patterns. Avoid exposing YouTrack instances to untrusted networks where possible.