CVE-2026-86498 describes an authorization bypass vulnerability in JetBrains YouTrack prior to versions 2025.3.160480 and 2026.1.14047. Specifically, PUT requests targeting link sub-resources could modify linked entities even if the user lacks update permissions. This issue is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 score of 7.7, indicating high severity, with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts integrity with a scope change.

An attacker with low privileges can modify linked entities without proper update permissions, potentially leading to unauthorized changes in the system. The integrity of data linked via these sub-resources can be compromised. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

A fix is available in JetBrains YouTrack versions 2025.3.160480 and 2026.1.14047. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's official patches. Patch status is confirmed by the version numbers in the description. No additional mitigation steps are indicated.