CVE-2026-86499: 
YouTrack vulnerability analysis and mitigation

CVE-2026-86499 is an information disclosure vulnerability in JetBrains YouTrack caused by missing authorization checks in predefined search fields, which leak all group names to any authenticated user regardless of visibility permissions. It affects all YouTrack versions before 2026.1.14047 and was published on September 7, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, JetBrains).

The root cause is classified as CWE-862 (Missing Authorization): the predefined search field functionality in YouTrack fails to enforce visibility permission checks before returning group name data to the requesting user. An authenticated attacker with low privileges can query these search fields over the network without any user interaction, causing the application to return group names that should be restricted by visibility settings. No complex exploitation technique is required — the flaw is inherent in how the search field API handles authorization (GitHub Advisory).

Any authenticated YouTrack user can enumerate all group names configured in the system, including groups they are not authorized to see. This constitutes a confidentiality breach with limited scope — integrity and availability are not affected. The exposed group names could assist an attacker in reconnaissance, enabling more targeted privilege escalation or social engineering attacks against specific organizational groups (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.162%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and exploitation requires valid credentials (low-privilege authenticated access) (GitHub Advisory).

JetBrains has released a fix in YouTrack version 2026.1.14047; upgrading to this version or later is the recommended remediation. As a temporary workaround prior to patching, administrators should restrict YouTrack access to only trusted users who are authorized to view group information. No configuration-only mitigation is documented beyond access restriction (JetBrains, GitHub Advisory).