A missing authorization check in JetBrains YouTrack lets users with read‑only project access overwrite project notification templates. The flaw is a classic CWE-863 issue where the system does not enforce proper privilege checks. By changing notification templates, malicious actors could alter the content of notifications sent to project stakeholders, potentially spreading phishing messages or misleading information, thereby compromising user trust and the integrity of communications.

The vulnerability affects all instances of JetBrains YouTrack running versions earlier than 2026.2.18991. No specific minor or patch versions are listed as unaffected, so all earlier releases are considered at risk.

The CVSS score of 7.6 indicates a high severity rating, and the EPSS score is unavailable, so the current probability of exploitation is uncertain. The flaw is not listed in the CISA KEV catalog. Attackers who already have read‑only project permissions—users who could normally only view data—can exploit the vulnerability, meaning no elevated privileges or network compromise is required. The impact is limited to the configuration of templates, but it can be leveraged for social engineering or to undermine communications integrity, which poses a significant operational risk.