CVE-2025-52878 in TeamCity
Summary
by MITRE • 06/23/2025
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/26/2025
This vulnerability in JetBrains TeamCity affects versions prior to 2025.03.3 and represents a critical access control flaw that undermines the system's authentication mechanisms. The issue stems from improper authorization checks within the application's user management interface, where usernames are inadvertently disclosed to unauthorized users who lack the necessary permissions to view such information. This exposure occurs through various API endpoints and web interfaces that should have enforced strict access controls to prevent information leakage. The vulnerability directly violates fundamental security principles by allowing unauthorized information disclosure, which can be categorized under CWE-200 - Information Exposure and CWE-668 - Improper Control of a Resource Through its Lifetime.
The technical implementation of this flaw involves the application's failure to properly validate user permissions before returning user account information through API responses or web page renders. Attackers can exploit this weakness by making unauthorized requests to TeamCity's user enumeration endpoints, potentially discovering valid usernames through response differences or direct access to user data. This information can serve as a foundation for further attacks including credential stuffing, brute force attempts, or social engineering campaigns targeting specific user accounts. The vulnerability's impact is particularly severe because usernames often serve as the first step in reconnaissance activities and can provide attackers with valuable information about user naming conventions and organizational structures.
From an operational perspective, this vulnerability significantly weakens TeamCity's security posture by creating an information disclosure channel that can be exploited by malicious actors. The exposure of usernames without proper permission checks enables attackers to build comprehensive user directories that can be used for targeted attacks against individual team members. This information leakage can facilitate credential harvesting attacks where attackers attempt to guess or brute force passwords for discovered usernames, potentially leading to full system compromise. The vulnerability also violates several ATT&CK tactics including T1589 - Obtain Capabilities and T1078 - Valid Accounts, as it provides attackers with legitimate-looking account names that can be used in subsequent phases of compromise.
Organizations utilizing TeamCity versions prior to 2025.03.3 should immediately implement mitigations including applying the latest security patches and updates provided by JetBrains. Additional protective measures involve configuring proper network segmentation to limit access to TeamCity interfaces, implementing strict firewall rules that restrict API access to authorized IP ranges, and monitoring for unusual enumeration patterns in system logs. Security teams should also review existing access control policies to ensure that proper role-based access controls are enforced throughout the application. The vulnerability demonstrates the critical importance of proper input validation and authorization checking in web applications, particularly in systems that manage user authentication and access control. Organizations should conduct comprehensive security assessments to identify similar information disclosure vulnerabilities in their application environments and ensure that all user-related data is properly protected through appropriate access controls and authorization mechanisms.