A high-severity authorization bypass in JetBrains YouTrack allows authenticated users to improperly modify linked entities, posing a significant risk to data integrity.

The vulnerability is an improper authorization flaw (CWE-863) triggered via PUT requests on link sub-resources. It requires a low-privilege authenticated user to perform the unauthorized modification of linked entities.

This vulnerability allows authenticated users to manipulate issue links and dependencies, which can lead to unauthorized data modification or the corruption of project management workflows. Given the CVSS score of 7.7, this flaw represents a significant risk to the integrity of project data and internal tracking processes. Exploitation could allow malicious actors to alter records that they are otherwise prohibited from changing, potentially undermining audit trails and administrative controls.

Immediate Action: Upgrade to the latest version of JetBrains YouTrack, ensuring you have moved beyond the affected versions listed above as specified by the vendor.

Proactive Monitoring: Review access logs for unusual PUT request patterns targeting link sub-resources or unauthorized modifications to issue relationships within the platform.

Compensating Controls: Implement strict role-based access control (RBAC) policies and utilize a Web Application Firewall (WAF) to filter or block suspicious API requests if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to data integrity within the YouTrack environment. Administrators should verify their current version and apply the necessary updates provided by JetBrains immediately to ensure that authorization checks are properly enforced on all linked entity operations.