JetBrains TeamCity versions prior to 2026.1, including 2025.11.5, contain a flaw that allows authenticated users to expose the server API to unauthorized access. The lack of proper authentication enforcement means that any user who can log in can potentially exploit the exposed API endpoints, leading to unauthorized data exposure or manipulation. This is classified as a CWE‑306 weakness, which reflects an authentication bypass or missing credential checks.

The affected product is JetBrains TeamCity. All installations of TeamCity released before the 2026.1 version, including the 2025.11.5 build, are vulnerable.

The CVSS score of 8.2 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to have valid credentials to log in first; once authenticated, the attacker can abuse the exposed API endpoints. Given the high severity and the need for authenticated access, the exploitation risk is moderate to high, especially in environments where TeamCity exposes additional services or sensitive data.