A critical IDOR vulnerability in the JetBrains YouTrack REST API allows authenticated attackers to access and modify restricted data, threatening project confidentiality and integrity.

This is an IDOR vulnerability (CWE-862) resulting from missing authorization checks in the application REST API. An authenticated user can leverage this to access or manipulate objects that should be restricted based on their current permission set.

With a CVSS score of 8.0, this vulnerability poses a significant risk to organizational data. Attackers can enumerate internal project structures, read confidential issue descriptions, and modify tasks, which directly impacts the confidentiality and integrity of project management operations.

Immediate Action: Update YouTrack to version 2026.2.18788, 2026.1.14055, 2025.3.161254 or later.

Proactive Monitoring: Review REST API access logs for anomalous requests, particularly those targeting objects outside of the user's expected scope or project permissions.

Compensating Controls: Restrict access to the YouTrack REST API to trusted IP addresses or internal networks until the software is updated.

Public Exploit Available: No

Administrators should prioritize the identified software updates to close the authorization gap. Because this vulnerability involves the REST API, it is essential to audit current integrations and service accounts to ensure they are not being used to perform unauthorized actions while the patch is being applied.