CWE-770: Excessive Resource Consumption is the weakness behind the flaw which allows a project administrator to trigger a denial of service by manipulating a notification template in JetBrains YouTrack versions prior to 2026.2.19197. The flaw enables a single privileged user to cause the notification service to exhaust resources, resulting in degraded or unavailable functionality for all users within that project.

JetBrains YouTrack before 2026.2.19197 is affected. Only users with project admin privileges can exploit the flaw, impacting the internal administration of the application rather than external users.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation but still worth addressing. The attack requires project admin credentials; once exploited it forces the application to hang, potentially causing interruptions to business processes. Prompt remediation is advisable to prevent service disruption.