CVE-2026-86500 is a privilege escalation vulnerability in JetBrains YouTrack versions prior to 2026.1.14047. The issue arises from a missing escalation check that enables users who have project update permissions to elevate their privileges by assigning themselves Project Admin status. This vulnerability is classified under CWE-266 (Incorrect Privilege Assignment). The CVSS v3.1 base score is 5.5, with vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no information about known exploits in the wild or vendor patch links provided.

An attacker with project update permissions can exploit this vulnerability to gain Project Admin privileges, potentially allowing them to perform administrative actions within the project that they should not be authorized to do. This could lead to unauthorized changes and increased control over project resources. The impact on confidentiality and integrity is low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the input data, users should monitor JetBrains communications for updates and apply any official fixes once available. Until then, restrict project update permissions to trusted users only to minimize risk.