The designation of this as a 'missing authorisation' flaw in the mailbox endpoint masks a structural security failure that differs fundamentally from typical IDOR vulnerabilities. The mailbox integration is an automation pathway, not a user interface—emails submitted to create or update issues execute without the human-speed constraints that limit UI-based exploitation. A compromised or malicious authenticated user can script hundreds of deletion requests via email and walk away; the system processes them asynchronously through the queue with no real-time feedback loop to signal abuse.
The CVSS 8.1 rating reflects arbitrary entity deletion, but the EPSS score of 0.0023 should not comfort defenders. This low score likely reflects measurement blindness rather than low risk—the mailbox endpoint doesn't generate the HTTP request fingerprints that EPSS telemetry monitors. If your threat model treats the low EPSS as an all-clear, you've misunderstood what the score actually measures.
More critically, this is an insider threat vulnerability disguised as an external-exploitation flaw. Any authenticated user—including those with read-only project access—can exploit the mailbox handler to delete issues they should not modify. Your audit logs likely attribute these deletions to 'mailbox integration' rather than the triggering user, making the exploitation pattern structurally invisible to anomaly detection rules that monitor user behavior. Before relying on existing logs, verify whether they capture the actual actor or only the processing pathway.
The patch spanning both 2025 and 2026 release trains indicates this flaw existed in shared handler code that predates YouTrack's current authorisation framework—likely never audited because the endpoint was treated as legacy plumbing. Audit other integration pathways (webhooks, external importers, API consumers) for structurally similar gaps; patching this instance does not guarantee the authorization model is consistently enforced across all non-UI entry points.
Priority actions: (1) Confirm your audit logs distinguish mailbox-triggered deletions and attribute them to the actual user, (2) review which authenticated users have mailbox integration access and whether that aligns with least privilege, (3) treat this as an insider-threat scenario in your risk assessment rather than external exploitation.