CVE-2026-103494: 
YouTrack vulnerability analysis and mitigation

CVE-2026-103494 is a privilege escalation vulnerability in JetBrains YouTrack that allows authenticated high-privileged users to escalate their privileges via user group membership changes. It affects all YouTrack versions before 2026.2.19422 and was disclosed on October 1, 2026. The vulnerability carries a CVSS v3.1 base score of 6.6 (Medium/High) (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), where YouTrack incorrectly handles user group membership changes in a way that allows an actor to gain an unintended sphere of control. An authenticated attacker with high privileges can manipulate group membership assignments to elevate their access beyond what is intended by the application's authorization model. Exploitation requires network access, high attack complexity, and existing high-privileged credentials, limiting the attack surface but not eliminating risk in environments with multiple administrative users (GitHub Advisory, JetBrains).

Successful exploitation results in full confidentiality, integrity, and availability impact on the affected YouTrack instance, as reflected in the CVSS scoring. An attacker who already holds high-privileged credentials can leverage this flaw to gain unauthorized access to additional system resources and functionality beyond their intended permissions, potentially compromising sensitive project data, issue tracking information, and administrative controls (GitHub Advisory).

There is no public proof-of-concept exploit available and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is further constrained by the requirement for high privileges and high attack complexity, making opportunistic exploitation unlikely (GitHub Advisory).

JetBrains has released a patch in YouTrack version 2026.2.19422, which resolves this vulnerability. Organizations should upgrade to this version or later as the primary remediation step. As an additional measure, administrators should review and restrict user group membership management permissions to only trusted administrators, and audit recent group membership changes for any unauthorized modifications (JetBrains, GitHub Advisory).