This vulnerability in JetBrains YouTrack versions prior to 2026.2.19197 allows an attacker to take over user accounts by replaying a notification signature. The flaw is categorized under CWE-863 (Incorrect Authorization), meaning the system fails to properly verify authorization before allowing sensitive actions. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality and integrity impact and low availability impact.

Successful exploitation results in account takeover, compromising user confidentiality and integrity within YouTrack. This could allow unauthorized access to sensitive project management data and potentially disrupt operations. The availability impact is low, indicating the service remains largely functional despite the compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information are provided, users should monitor JetBrains advisories for updates. Until a fix is available, consider restricting access to YouTrack instances and monitoring for suspicious activity related to notification signatures.