CVE-2025-54532: JetBrains TeamCity Information Disclosure

CVE-2025-54532 Overview

CVE-2025-54532 is an improper access control vulnerability in JetBrains TeamCity versions before 2025.07. The flaw allows authenticated users to view build settings they should not have access to by leveraging snapshot dependencies. The weakness is classified under CWE-863: Incorrect Authorization and affects the continuous integration and deployment workflows managed through TeamCity.

Critical Impact
An authenticated low-privilege user can disclose protected build configuration settings from other projects by abusing snapshot dependency relationships.

Affected Products

JetBrains TeamCity versions prior to 2025.07
On-premise TeamCity server installations
CI/CD pipelines relying on project-level access segregation

Discovery Timeline

2025-07-28 - CVE-2025-54532 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54532

Vulnerability Analysis

The vulnerability resides in TeamCity's handling of snapshot dependencies between build configurations. Snapshot dependencies let one build consume the state of another build, which requires cross-referencing configurations across projects. The access control checks did not fully validate whether the requesting user had permission to view the referenced configuration's settings. As a result, a user with limited project access could enumerate and read settings belonging to builds in other projects.

The exposed data is limited to build configuration settings rather than secrets or artifacts. Still, build settings often reveal internal naming conventions, parameter definitions, agent requirements, and pipeline logic that aid reconnaissance against the broader CI/CD environment.

Root Cause

The root cause is an authorization check failure [CWE-863] in the snapshot dependency resolution path. The server trusted the dependency reference without re-validating the requesting principal's authorization against the dependent configuration's project permissions.

Attack Vector

Exploitation requires network access to the TeamCity server and a valid low-privilege account. The attacker constructs or inspects a build configuration that references a snapshot dependency pointing at a target configuration in a restricted project. TeamCity returns settings data for the dependent build, bypassing project-level isolation. No user interaction is required, and the attack does not affect integrity or availability.

For technical specifics, refer to the JetBrains Security Issues Fixed page.

Detection Methods for CVE-2025-54532

Indicators of Compromise

Unusual read access to build configuration endpoints by accounts not assigned to the parent project
API or UI requests that enumerate buildTypes or snapshot-dependencies across project boundaries
Audit log entries showing cross-project snapshot dependency references created by low-privilege users

Detection Strategies

Review TeamCity audit logs for access patterns that cross project boundaries, especially from accounts with limited role assignments
Correlate REST API calls against /app/rest/buildTypes and snapshot dependency endpoints with user role scope
Baseline normal CI/CD user behavior and flag deviations in configuration browsing activity

Monitoring Recommendations

Forward TeamCity server logs and audit events to a centralized SIEM for retention and correlation
Enable detailed authorization decision logging on the TeamCity server
Alert on repeated 200 responses to configuration read requests following prior 403 denials by the same principal

How to Mitigate CVE-2025-54532

Immediate Actions Required

Upgrade all TeamCity server instances to version 2025.07 or later
Audit existing snapshot dependencies for cross-project references that should not exist
Review user role assignments and remove unnecessary project access granted during the exposure window

Patch Information

JetBrains addressed the issue in TeamCity 2025.07. Administrators should apply the official update distributed through the JetBrains download channels. See the JetBrains Security Issues Fixed advisory for the full list of resolved issues included in the release.

Workarounds

Restrict TeamCity server network exposure to trusted internal networks until the patch is deployed
Minimize the number of accounts holding any project-level access on the server
Remove snapshot dependency configurations that span sensitive projects where feasible

bash

# Verify installed TeamCity version from the server host
curl -s http://teamcity.internal:8111/app/rest/server \
  -H "Accept: application/json" \
  -u "<admin>:<token>" | jq '.version'

# Expected output after patching: a version string >= 2025.07