CVE-2026-86479: CWE-862 in JetBrains YouTrack

JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 suffer from a missing authorization vulnerability (CWE-862) that permits access to restricted REST API resources through IDOR. This flaw allows users with limited privileges to bypass access controls and retrieve sensitive information. The CVSS 3.1 base score is 8.0, indicating high severity, with network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

An attacker with some level of privileges can exploit this vulnerability to access restricted API resources that should be protected, potentially leading to unauthorized disclosure and modification of sensitive data. The vulnerability does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch links are provided, users should monitor JetBrains advisories for updates. Until a fix is available, restrict access to the affected YouTrack API endpoints and review user privileges to minimize exposure.