important · Privilege escalation
YouTrack Helpdesk can accept a self-asserted email address as account identity.
Affects
JetBrains YouTrack, a hosted or self-managed issue-tracking and helpdesk system used by development and support teams.
An unauthenticated caller who can reach affected Helpdesk functionality can claim a target user's email address without proving mailbox ownership and receive that account's authority.