Technical impact
TeamCity before 2025.11.3 failed to properly enforce authorization checks, enabling anyone with project developer rights to add new parameters to a build configuration. This mis‑authorization can let a user modify build behavior, inject undesired variables, or expose confidential data in the CI pipeline, potentially compromising build integrity and confidentiality. The weakness is identified as CWE‑862: Authorization Bypass Through User-Controlled Key.
Affected Systems
JetBrains TeamCity systems running any version earlier than 2025.11.3 are affected. No explicit patch version is listed, but all releases prior to 2025.11.3 are vulnerable.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity. EPSS is less than 1%, showing a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need project developer access; the bug allows elevation of their configuration privileges without additional zero‑day exploits. The likely attack vector is internal or compromised developer accounts with existing Access rights, so organizations with broad developer permissions should examine role assignments.
