Jetbrains Teamcity vulnerabilities

CVE-2019-12846 [MEDIUM] CVE-2019-12846: A user without the required permissions could gain access to some JetBrains TeamCity settings. The i A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.

CVE-2024-28173 [MEDIUM] CWE-201 CVE-2024-28173: In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type c In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

CVE-2025-52878 [MEDIUM] CWE-862 CVE-2025-52878: In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permission In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

CVE-2020-7908 [MEDIUM] CWE-269 CVE-2020-7908: In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.

CVE-2019-18365 [MEDIUM] CWE-269 CVE-2019-18365: In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages. In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

CVE-2020-15826 [MEDIUM] CWE-269 CVE-2020-15826: In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

CVE-2023-34224 [MEDIUM] CWE-601 CVE-2023-34224: In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

CVE-2021-25775 [LOW] CVE-2021-25775: In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any o In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

CVE-2025-57733 [LOW] CWE-77 CVE-2025-57733: In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email co In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

CVE-2025-67739 [LOW] CWE-939 CVE-2025-67739: In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

CVE-2025-68164 [LOW] CWE-203 CVE-2025-68164: In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test

CVE-2025-68162 [LOW] CWE-829 CVE-2025-68162: In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configura In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration

CVE-2021-31906 [LOW] CVE-2021-31906: In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.

CVE-2026-28196 [LOW] CWE-459 CVE-2026-28196: In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on dis In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

CVE-2021-26309 [LOW] CWE-668 CVE-2021-26309: Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible becaus Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.

CVE-2020-11686 [LOW] CVE-2020-11686: In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity se In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.