This vulnerability in JetBrains YouTrack allows an unauthenticated attacker to access and download database backups by leveraging a shared draft signature mechanism. The flaw is present in versions prior to 2025.3.156085, 2026.1.13913, and 2026.2.18112. It is categorized as CWE-288, which involves authentication bypass through an alternate path or channel. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. No official patch or remediation level has been disclosed yet, and no known exploits in the wild have been reported.

An unauthenticated attacker can download sensitive database backups from the affected YouTrack instances, leading to a complete compromise of confidentiality and integrity of the data stored in those backups. This could expose sensitive project management data and potentially other confidential information contained within the backups. The availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to YouTrack instances and their backup storage locations, and monitor for any unusual access patterns related to shared draft signatures. Follow JetBrains' official communications for updates on patches or temporary mitigations.