CVE-2026-123336: Low severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains YouTrack to a version that resolves this vulnerability.
Fixed in 2026.2.19728

Event History

Nov 6, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need?

Exploitation requires low-level authenticated privileges and network access. No user interaction is required, but the attack complexity is rated high.

What is the likely security impact?

The stated impact is limited to low availability impact. No confidentiality or integrity impact is indicated.

How can I determine whether an instance is affected?

Instances running a YouTrack version earlier than 2026.2.19728 are affected. The issue involves bypassing the attachment size limit through AI assistant thread conversion.

Is there evidence that default configurations are affected or that a workaround is available?

The provided information does not state whether the default configuration is affected or identify a workaround. Updating to 2026.2.19728 or later is the version-based remediation indicated by the affected-version range.

CVE-2026-123336: Low severity vulnerability

Remediation

Event History

Frequently Asked Questions

What access does an attacker need?

What is the likely security impact?

How can I determine whether an instance is affected?

Is there evidence that default configurations are affected or that a workaround is available?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need?

What is the likely security impact?

How can I determine whether an instance is affected?

Is there evidence that default configurations are affected or that a workaround is available?