CVE-2026-103495: 
YouTrack vulnerability analysis and mitigation

CVE-2026-103495 is a missing authorization vulnerability in JetBrains YouTrack that allows authenticated low-privileged users to reload translation catalogs without proper authorization checks. It affects all YouTrack versions before 2026.2.19422 and was disclosed on October 1, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, JetBrains).

The root cause is classified as CWE-862 (Missing Authorization): the application fails to perform an authorization check when an authenticated actor attempts to trigger a reload of translation catalogs. An attacker with a low-privileged network account can send a crafted request to the translation catalog reload endpoint without requiring elevated permissions, administrator approval, or user interaction. No public proof-of-concept or detailed technical write-up is currently available (GitHub Advisory).

Successful exploitation allows a low-privileged authenticated user to trigger an unauthorized reload of translation catalogs, resulting in a low availability impact — potentially disrupting application functionality for other users during the reload operation. There is no confidentiality or integrity impact, and the scope is unchanged, meaning the effect is limited to the YouTrack application itself without lateral movement potential (GitHub Advisory, JetBrains).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept code, and no known threat actor attribution at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid low-privileged account, which limits opportunistic attack surface (GitHub Advisory).

JetBrains has released a patch in YouTrack version 2026.2.19422, which addresses the missing authorization check. Organizations should upgrade to version 2026.2.19422 or later as the primary remediation step. As interim mitigations, administrators should restrict access to translation catalog management functions to authorized administrators only and implement audit logging for catalog management operations (JetBrains, GitHub Advisory).