CVE-2025-54533: JetBrains TeamCity Information Disclosure

CVE-2025-54533 is an information disclosure vulnerability in JetBrains TeamCity caused by improper access control. Attackers can exploit this flaw to access sensitive build settings through VCS configuration, potentially exposing critical project data. This article covers the technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2025-54533 Overview

CVE-2025-54533 is an improper access control vulnerability in JetBrains TeamCity versions prior to 2025.07. The flaw allows an authenticated user with low privileges to disclose build settings through Version Control System (VCS) configuration. The weakness is classified as [CWE-863] Incorrect Authorization. JetBrains addressed the issue in TeamCity 2025.07.

Critical Impact
Authenticated attackers with limited privileges can read build settings intended to be restricted, exposing sensitive continuous integration and delivery pipeline configuration data.

Affected Products

JetBrains TeamCity versions before 2025.07
On-premises TeamCity server installations
TeamCity projects that expose VCS configuration to low-privileged users

Discovery Timeline

2025-07-28 - CVE-2025-54533 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54533

Vulnerability Analysis

The vulnerability resides in how TeamCity enforces authorization checks on VCS configuration endpoints. A user who can authenticate to the server can access build settings tied to VCS roots even when they should not have visibility into those projects. The disclosure is limited to confidentiality of build settings and does not affect integrity or availability of the CI/CD pipeline.

Build settings in TeamCity often contain references to repository URLs, branch specifications, trigger rules, and build parameter names. Exposure of this metadata can help an attacker map internal repositories, identify build dependencies, and plan follow-on attacks against source control or dependent systems.

Root Cause

The root cause is an improper access control check ([CWE-863]) on VCS configuration retrieval logic. TeamCity did not consistently verify that the requesting principal possessed the required project-level permission before returning build configuration data derived from the VCS root. Authorization decisions relied on partial context that a low-privileged user could satisfy.

Attack Vector

Exploitation requires network access to the TeamCity web interface and valid low-privilege credentials. No user interaction is needed. An attacker issues authenticated requests against VCS configuration endpoints and receives build settings that should be restricted by role or project scope. Because the attack occurs over standard HTTPS traffic, it produces no distinctive network signature.

No public proof-of-concept exploit or Exploit-DB entry has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-54533

Indicators of Compromise

Unusual authenticated HTTP requests from low-privileged accounts against TeamCity VCS configuration endpoints under /app/rest/vcs-roots or related project settings paths
Access patterns where a single user account enumerates VCS roots across many projects in a short timeframe
TeamCity audit log entries showing settings retrieval by users lacking explicit project permissions

Detection Strategies

Review TeamCity access logs for authenticated users accessing VCS root or project settings endpoints they do not typically use
Compare user role assignments against actual VCS configuration reads to identify authorization gaps
Correlate TeamCity audit events with identity provider logs to detect anomalous credential use

Monitoring Recommendations

Forward TeamCity server logs to a centralized SIEM for retention and correlation
Alert on spikes in GET requests to VCS configuration REST endpoints by non-administrative accounts
Monitor for account credential reuse across TeamCity and connected VCS systems such as GitHub or GitLab

How to Mitigate CVE-2025-54533

Immediate Actions Required

Upgrade TeamCity to version 2025.07 or later on all on-premises servers
Audit user roles and remove unnecessary access to projects containing sensitive build configurations
Rotate any credentials, tokens, or secrets referenced in build settings that may have been exposed

Patch Information

JetBrains fixed CVE-2025-54533 in TeamCity 2025.07. Administrators should apply the update using the standard TeamCity upgrade procedure and validate the version after restart. Details are published in the JetBrains Security Fixes Summary.

Workarounds

Restrict TeamCity web interface access to trusted networks using a reverse proxy or firewall allowlist until patching is complete
Review and tighten per-project role assignments so that only intended users hold View project and related permissions
Store sensitive values as TeamCity password parameters rather than plain build settings to reduce disclosure impact

bash

# Verify installed TeamCity server version
curl -s -u <admin_user>:<admin_pass> \
  https://teamcity.example.com/app/rest/server \
  | grep -oE 'version="[^"]+"'

# Expected output should show 2025.07 or later, for example:
# version="2025.07"