CVE-2026-123336

YouTrack AI thread conversion bypasses attachment size limits

JetBrains · YouTrack AI assistant

First documented disclosure · Review checkpoint

Summary

Converting an AI assistant thread can bypass the configured attachment-size restriction.

Severity and exploitation evidence

Low · 3.1/10 · CVSS 3.1. Severity source.

Exploitation not established: JetBrains publishes the fixed issue and CVE; no exploit demonstration or malicious activity is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The conversion route fails to enforce the attachment resource limit. The vendor does not publish the exact request or internal handler.

Conditions required

The CNA score describes a low-privilege network user and high attack complexity. Exact account permissions and size requirements are unspecified.

Potential impact

The vendor identifies a low availability impact; data theft or code execution is not claimed.

Affected versions and configurations

Before 2026.2.19728.

Fix and mitigation status

2026.2.19728.

Practical next steps

Update YouTrack and verify that AI thread conversion respects attachment quotas.

Operating lesson

Apply upload limits to conversion and import paths as well as direct uploads.

Evidence and limits

The vendor’s public security table and CNA both date the issue November 6. The table identifies JT-98718 and the fixed build. Technical details remain limited.

Sources