PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-86495 JetBrains CVE debrief

CVE-2026-86495 debrief based on CVE Program and NVD records. The vulnerability allows users to create knowledge base articles in inaccessible projects due to missing permission checks in JetBrains YouTrack before 2026.2.18687. This medium-severity issue may lead to information disclosure or unauthorized changes. Defenders should verify YouTrack instances for unauthorized knowledge base article creation and prioritize remediation. Evidence from CVE Program and NVD records indicates a need for verification of permission checks and inventory checks to determine affected instances.

Vendor
JetBrains
Product
YouTrack
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-07
Original CVE updated
2026-09-07
Advisory published
2026-09-07
Advisory updated
2026-09-07

Who should care

Defenders of JetBrains YouTrack instances should assess exposure and prioritize remediation. This vulnerability may impact organizations using YouTrack for project management and knowledge base maintenance.

Why it matters

CVE-2026-86495 is a medium-severity vulnerability in JetBrains YouTrack, allowing creation of knowledge base articles in inaccessible projects. Defenders of YouTrack instances should assess exposure and prioritize remediation. The vulnerability requires verification of permission checks and inventory checks to determine affected instances.

  • Defenders must verify YouTrack instances for unauthorized knowledge base article creation
  • Remediation priority is medium, as exploitation requires authenticated access
  • Verification of permission checks for knowledge base article creation is necessary
  • Inventory checks are required to determine affected YouTrack instances

Technical summary

CVE-2026-86495 is a medium-severity vulnerability in JetBrains YouTrack before 2026.2.18687. The vulnerability allows users to create knowledge base articles in inaccessible projects due to missing permission checks. This could potentially lead to information disclosure or unauthorized changes to knowledge base articles.

Defensive priority

Medium priority for defenders of JetBrains YouTrack instances

Recommended defensive actions

  • Review and update JetBrains YouTrack instances to version 2026.2.18687 or later
  • Verify permission checks for knowledge base article creation in YouTrack projects
  • Monitor YouTrack instances for unauthorized knowledge base article creation

Evidence notes

Evidence from CVE Program and NVD records indicates a medium-severity vulnerability in JetBrains YouTrack before 2026.2.18687, allowing creation of knowledge base articles in inaccessible projects due to missing permission checks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-86495 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-86495

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-86495 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86495

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.