JetBrains YouTrack (versions before 2026.2.16593) contains an authorization flaw in the “app configurations” endpoint. In plain terms, an attacker who can reach the endpoint could modify project settings without proper permission checks, due to “improper authorisation” in how the application enforces access control for configuration changes.
The issue is described as improper authorization in the app configurations endpoint. The NVD summary indicates that the vulnerability allowed modifying project settings. The attack vector is network-based (AV:N) and the required privileges are low (PR:L), with no user interaction required (UI:N). The exploitation mechanism, as characterized by the description, is an HTTP request to the app configurations endpoint that succeeds in changing project configuration despite the caller not being properly authorized for that action. The references provided do not include additional technical details such as specific controller/handler names, request parameters, or code paths, so the analysis is limited to the endpoint-level authorization failure and its effect (project settings modification).
Impact is primarily integrity-related: an attacker can change project settings (C:N/I:H/A:N). Confidentiality and availability are not indicated as directly impacted by the NVD description (C:N, A:N). The CVSS score is 5.3, rated “medium,” with conditions reflecting that the attacker needs some level of access (PR:L) and that exploitation complexity is higher (AC:H). The blast radius is constrained to the ability to alter project configuration within YouTrack, which can affect how projects behave and how they are managed, but the provided information does not specify further downstream effects.
Mitigation: upgrade JetBrains YouTrack to a fixed version. The NVD description states that versions “before 2026.2.16593” are affected, implying that 2026.2.16593 and later include the fix. No workaround or detection guidance is included in the provided reference content. If immediate upgrading is not possible, the only safe mitigation implied by the nature of the issue is to restrict network access to the affected endpoint and ensure only properly authorized users/services can reach it; however, specific configuration steps are not present in the supplied references.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-862