JetBrains YouTrack CVE-2026-100274

Exploitation requires an authenticated account with project Admin privileges on the target YouTrack instance (PR:L) and the ability to create or modify a notification template, which is the specific feature abused to cause uncontrolled resource consumption. No end-user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The principal limiting factor is the privilege gate: an ordinary or unauthenticated user cannot trigger this, so realistic risk is confined to malicious or compromised project administrators. All YouTrack versions before 2026.2.19197 are affected; upgrading to the patched build removes the condition.

This is a genuine but limited-severity availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity denial-of-service that requires an authenticated attacker holding project Admin privileges (PR:L) and produces availability impact only, with no confidentiality or integrity loss (CWE-770, uncontrolled resource consumption). The exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced in the input, so there is no signal of active or automated exploitation. No SSVC decision data was provided. The practical risk is contained by the privilege requirement: only a user already trusted to administer a YouTrack project can trigger it, making this an insider/abuse-of-trust or post-compromise DoS rather than a broadly exploitable pre-auth flaw. Net assessment: a real, patch-worthy availability bug but a low-to-medium operational priority, not a high-urgency threat despite the medium CVSS.

A user who already holds project Admin rights in YouTrack crafts or edits a notification template so that its processing consumes excessive resources, exhausting server capacity and rendering the instance unavailable to other users. No user interaction or additional authentication step is needed once the malicious template is triggered. No public proof-of-concept exploit code is referenced in the available data.