In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.