CVE-2025-52878: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-52878 is an information disclosure vulnerability in JetBrains TeamCity where usernames are exposed to users without proper permissions. It affects all versions of JetBrains TeamCity before 2025.03.3. The vulnerability was published on June 23, 2025, with a patch released by June 25, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (JetBrains Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the application fails to enforce proper access controls before returning username data to authenticated users who lack the necessary permissions to view it. The attack vector is network-based and requires low-privilege authentication (a valid account), with no user interaction needed. An authenticated attacker with minimal privileges can query or browse functionality that inadvertently returns usernames belonging to other accounts in the TeamCity system (Red Hat CVE, JetBrains Advisory).

Successful exploitation allows unauthorized authenticated users to enumerate usernames within the TeamCity instance, resulting in a limited confidentiality impact with no effect on integrity or availability. Exposed usernames could facilitate follow-on attacks such as credential stuffing, phishing, or social engineering targeting identified accounts. The scope is limited to the affected TeamCity instance and does not directly enable lateral movement or code execution (Red Hat CVE).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.002%, reflecting a very low probability of exploitation in the near term (Red Hat CVE, JetBrains Advisory).

JetBrains has released TeamCity version 2025.03.3, which addresses this vulnerability. Organizations should upgrade to version 2025.03.3 or later as the primary remediation step. Additionally, administrators should review and tighten user access controls, audit existing user permissions, and monitor for any unauthorized information access within the TeamCity environment (JetBrains Advisory).

Coverage of this vulnerability has been limited to standard vulnerability aggregation platforms and security feeds, with no notable researcher commentary or significant community discussion identified. Qualys included it in their June 2025 web application detections publication, and RedPacketSecurity noted it on Mastodon shortly after disclosure. No major media coverage or vendor statements beyond the JetBrains advisory have been observed.