A flaw in JetBrains YouTrack allows an attacker to bypass the attachment size limit by using the AI assistant to convert a thread, causing the system to accept files larger than the configured maximum. This could lead to resource exhaustion or denial of service if the attacker uploads excessively large files. The weakness is classified as a resource allocation vulnerability (CWE-770).

JetBrains YouTrack versions prior to 2026.2.19728 are affected. Users running those releases must verify their version and consider upgrading to a fixed release.

The CVSS score of 3.1 indicates low severity, and no EPSS data is available, suggesting limited known exploitation. The flaw is not listed in CISA KEV. The likely attack vector involves an authenticated user with access to the AI assistant feature initiating a thread conversion that manipulates attachment handling. Because the vulnerability exploits a known configuration setting, a skilled user could leverage this weakness if the AI assistant is enabled.