CVE-2026-86500: 
YouTrack vulnerability analysis and mitigation

CVE-2026-86500 is a privilege escalation vulnerability in JetBrains YouTrack caused by a missing escalation check that allows a user with project update permissions to grant themselves the Project Admin role. It affects all YouTrack versions before 2026.1.14047 and was published on September 7, 2026. The CVE was assigned by JetBrains and carries a CVSS v3.1 base score of 5.5 (Medium/Moderate) (GitHub Advisory, JetBrains).

The root cause is classified as CWE-266 (Incorrect Privilege Assignment): the application fails to enforce an authorization check when a user with project update permissions attempts to assign themselves a higher-privilege role (Project Admin). Because the escalation check is absent, the permission assignment API or UI endpoint does not validate whether the requesting user is authorized to elevate their own role, allowing the operation to succeed without additional approval. The attack vector is network-based, requires no user interaction, and requires only high-level (project update) privileges as a precondition (GitHub Advisory).

A user with project update permissions can escalate their own privileges to the Project Admin role without additional authorization, gaining full administrative control over the affected project. This could allow the attacker to modify project settings, manage other users' permissions within the project, access sensitive project data, and potentially pivot to broader administrative actions depending on the YouTrack deployment configuration. Availability is not directly impacted, but confidentiality and integrity of project data are both at low risk of compromise (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.15–0.16%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and SSVC assessment indicates it is not automatable and has only partial technical impact. Exploitation requires an authenticated account with at least project update permissions, limiting the attacker pool.

1. Reconnaissance: Identify a JetBrains YouTrack instance running a version prior to 2026.1.14047, accessible over the network.
2. Obtain project update permissions: Log in with an account that has been granted project update permissions on a target project (or compromise such an account).
3. Trigger privilege escalation: Use the YouTrack UI or API to modify project role assignments, specifically assigning the Project Admin role to the attacker's own account — an action that should normally be restricted but is not properly checked.
4. Achieve Project Admin access: With the escalated role, the attacker gains full administrative control over the project, including managing members, settings, and sensitive project data (GitHub Advisory).

• Logs: YouTrack audit logs showing a user with project update permissions assigning themselves the Project Admin role without a corresponding approval or admin action.
• Logs: Unexpected role change events in YouTrack's activity or audit trail, particularly self-assignment of elevated roles.
• Application Behavior: Users appearing in the Project Admin role who were not explicitly granted that role by a system administrator.

JetBrains has released a fix in YouTrack version 2026.1.14047. Organizations should update to this version or later as the primary remediation step (JetBrains, GitHub Advisory). As an interim measure, administrators should audit current project permission assignments — particularly users with project update permissions — and verify that no unauthorized privilege escalation has already occurred by reviewing Project Admin role assignments. Restricting project update permissions to only trusted users can reduce the attack surface until patching is complete.