CVE-2026-86496: 
YouTrack vulnerability analysis and mitigation

CVE-2026-86496 is a missing access control vulnerability in JetBrains YouTrack that exposes reporter email addresses through the Helpdesk authorized reporters interface. It affects all YouTrack versions before 2026.2.18769 and was published on September 7, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), requiring only low-level authenticated access to exploit (GitHub Advisory, JetBrains).

The root cause is classified as CWE-862 (Missing Authorization): YouTrack fails to perform adequate authorization checks when authenticated users attempt to access the Helpdesk authorized reporters interface, allowing them to view reporter email addresses without the necessary permissions. An attacker with any low-privileged account can send a network request to the affected endpoint and retrieve email addresses of Helpdesk reporters. No special configuration or user interaction is required beyond holding a valid authenticated session (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of reporter email addresses stored in the YouTrack Helpdesk module, constituting a confidentiality breach with no impact on integrity or availability. Exposed email addresses could be leveraged for targeted phishing, social engineering, or spam campaigns against users who have submitted Helpdesk tickets. The scope is limited to the affected YouTrack instance and does not directly enable lateral movement or further system compromise (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is approximately 0.162–0.166%, placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable (GitHub Advisory).

1. Authentication: Log in to the target JetBrains YouTrack instance with any low-privileged user account.
2. Identify the Helpdesk endpoint: Navigate to or directly query the Helpdesk authorized reporters interface within YouTrack, which lacks proper authorization enforcement.
3. Access reporter data: Issue an HTTP request to the Helpdesk authorized reporters endpoint; due to the missing access control check, the server returns reporter email addresses without verifying whether the requesting user has permission to view them.
4. Harvest email addresses: Collect the exposed email addresses for potential downstream abuse such as phishing or social engineering targeting Helpdesk reporters (GitHub Advisory).

• Logs: Unusual or repeated access to Helpdesk authorized reporters API endpoints by low-privileged user accounts in YouTrack access logs; access patterns inconsistent with normal user roles.
• Network: HTTP requests from authenticated low-privilege sessions targeting Helpdesk reporter management endpoints, particularly if originating from accounts not associated with Helpdesk administration.
• Behavioral: Bulk or automated queries to the Helpdesk reporters interface from a single user account in a short time window, suggesting enumeration activity.

JetBrains has released a patch in YouTrack version 2026.2.18769, which enforces proper authorization checks on the Helpdesk authorized reporters interface. Organizations should upgrade to version 2026.2.18769 or later as the primary remediation. As an interim measure, administrators should review and restrict access to Helpdesk reporter data to authorized personnel only, and audit existing user permissions within the YouTrack Helpdesk module (JetBrains, GitHub Advisory).