JetBrains TeamCity, in versions before 2026.1, contains a flaw where the system fails to enforce proper authorization checks on requests for build configuration parameters. This improper permission handling allows an authenticated user to view sensitive configuration data that should be protected, leading to unauthorized disclosure of information. The weakness aligns with CWE-862, Insufficient Authorization, meaning the application does not verify whether a user has sufficient rights before granting access to restricted resources.

JetBrains TeamCity, all releases prior to 2026.1 are affected. The vulnerability exists across environments where the software is deployed, regardless of host operating system, because the permission flaw is inherent to the TeamCity code base.

The CVSS score of 7.6 indicates a high severity vulnerability, and although the EPSS score is not available, the absence of a CISA KEV listing does not diminish the risk to organizations that deploy TeamCity. The likely attack vector is an authenticated attacker who can exploit misconfigured or overly permissive user accounts to read build configuration parameters. If an attacker can obtain or guess a valid session, they may extract this sensitive data, potentially exposing internal project details, credentials, or deployment settings.