JetBrains YouTrack prior to 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
jetbrains youtrack