In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

Published Feb 3, 2021 · Updated Aug 4, 2024 · Assigned by mitre