CVE-2026-86495: Medium severity JetBrains YouTrack vulnerability
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with low-level privileges in YouTrack. The attack can be performed remotely and does not require user interaction.
What is the impact of successful exploitation?
A low-privileged user can create knowledge base articles in projects that should be inaccessible to them. The reported impact is unauthorized modification; confidentiality and availability impacts are not indicated.
Which deployments are affected?
JetBrains YouTrack versions before 2026.2.18687 are affected. The provided information does not identify a configuration prerequisite, so deployments on earlier versions should be assessed.
How can I determine whether my instance is affected?
Check the running YouTrack version. Instances earlier than 2026.2.18687 are affected; the supplied data does not provide a detection method for identifying prior exploitation.