CVE-2025-52878: JetBrains TeamCity Information Disclosure

CVE-2025-52878 Overview

CVE-2025-52878 is an information disclosure vulnerability in JetBrains TeamCity before version 2025.03.3. The flaw exposes usernames to authenticated users who lack proper permissions to view them. The issue is classified under [CWE-862] Missing Authorization and affects the TeamCity continuous integration and deployment server. An authenticated attacker with low privileges can enumerate account usernames across the TeamCity instance over the network. JetBrains addressed the issue in TeamCity 2025.03.3.

Critical Impact
Authenticated low-privilege users can enumerate usernames across the TeamCity instance, enabling targeted credential attacks and reconnaissance against build infrastructure.

Affected Products

JetBrains TeamCity versions prior to 2025.03.3
On-premises TeamCity server deployments
TeamCity instances exposed to authenticated internal users

Discovery Timeline

2025-06-23 - CVE CVE-2025-52878 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52878

Vulnerability Analysis

The vulnerability stems from missing authorization checks on functionality that returns user account identifiers. TeamCity failed to enforce permission boundaries before disclosing usernames to the requesting account. Any authenticated user, regardless of role, could obtain usernames belonging to other TeamCity principals.

The disclosure is limited to usernames and does not affect integrity or availability of the service. The impact is reconnaissance-focused rather than directly destructive. Attackers can use the harvested usernames to craft targeted password spraying, phishing, or social-engineering campaigns against developers and build administrators.

Root Cause

The root cause is a missing authorization check [CWE-862] in a code path that exposes user identity data. The permission model that governs access to the user list was not consistently applied to all endpoints returning username values. As a result, callers without the required role received username data that should have been restricted.

Attack Vector

Exploitation requires network access to the TeamCity server and valid low-privilege credentials. No user interaction is required. The attacker issues an authenticated request to the affected functionality and receives username data for accounts they are not authorized to view. The exposed usernames can then be fed into follow-on attacks targeting authentication endpoints, source control systems, or integrated identity providers.

See the JetBrains Security Issues Fixed advisory for additional details.

Detection Methods for CVE-2025-52878

Indicators of Compromise

Authenticated API or web requests from low-privilege accounts that enumerate user-related endpoints at an abnormal rate.
Unusual spikes in requests targeting TeamCity REST endpoints that return user data, especially from accounts without administrative roles.
Subsequent authentication failures or password-spray patterns against accounts whose usernames were previously enumerated.

Detection Strategies

Review TeamCity access logs for repeated requests to user-listing endpoints originating from standard developer or guest accounts.
Correlate TeamCity username enumeration activity with downstream authentication events in Active Directory, Entra ID, or source control systems.
Baseline normal API usage per role so deviations by low-privilege accounts can be flagged.

Monitoring Recommendations

Forward TeamCity teamcity-server.log and audit logs to a centralized SIEM for long-term analysis.
Alert on authentication anomalies that follow enumeration patterns, including distributed login attempts across many recently queried usernames.
Monitor service accounts and CI tokens for unexpected use of user-management APIs.

How to Mitigate CVE-2025-52878

Immediate Actions Required

Upgrade JetBrains TeamCity to version 2025.03.3 or later.
Audit existing TeamCity user accounts and remove inactive or unnecessary low-privilege accounts that could be used for enumeration.
Rotate credentials and tokens for any accounts suspected of being leveraged for reconnaissance.

Patch Information

JetBrains fixed the issue in TeamCity 2025.03.3. Administrators should review the JetBrains Security Issues Fixed advisory and apply the update through standard TeamCity upgrade procedures. Verify the server version after upgrade using the TeamCity administration interface.

Workarounds

Restrict TeamCity network exposure so only trusted users and networks can authenticate to the server.
Enforce strong, unique passwords and multi-factor authentication for all TeamCity accounts to reduce the value of enumerated usernames.
Minimize the number of accounts with access to the TeamCity instance until the patch is applied.

bash

# Verify TeamCity server version after upgrade
curl -u <admin>:<password> \
  https://teamcity.example.com/app/rest/server \
  -H "Accept: application/json"