CVE-2026-86498

CVE-2026-86498 is an incorrect authorization flaw (CWE-863) in JetBrains YouTrack, the company's issue-tracking and project-management server. An authenticated user with low privileges can send PUT requests to link sub-resources in the REST API, and the server applies the changes to the linked entities without verifying that the user holds update permission on them. The attacker gains unauthorized modification of linked issue data, affecting integrity only — the CVSS vector shows no confidentiality or availability impact and requires no user interaction. Any YouTrack deployment running a version earlier than the fixed builds is exposed, which covers both self-hosted servers and potentially the hosted service until patched. Exploitation has not been reported: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.2% (7th percentile).

What to do: Upgrade YouTrack self-hosted instances to 2025.3.160480 (2025.3 line) or 2026.1.14047 (2026.1 line), whichever branch you run. As an interim measure, restrict which accounts can issue write (PUT) requests against the REST API's link sub-resources, and review recently modified linked issues for changes made by users without update permission on those entities.