CVE-2025-59455: 
JetBrains TeamCity vulnerability analysis and mitigation

In JetBrains TeamCity before version 2025.07.2, a project isolation bypass vulnerability was discovered due to a race condition. The vulnerability was assigned CVE-2025-59455 and was disclosed on September 17, 2025 (NVD, JetBrains Advisory).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). It has been assigned a CVSS v3.1 base score of 4.2 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. This indicates that the vulnerability is network accessible, requires high attack complexity, low privileges, no user interaction, has unchanged scope, and can impact both confidentiality and integrity at a low level, with no impact on availability (AttackerKB).

The vulnerability could allow an attacker to bypass project isolation mechanisms in TeamCity. This could potentially lead to unauthorized access to project resources and information disclosure, as well as potential integrity issues, though both at a low severity level (NVD).

The vulnerability has been fixed in TeamCity version 2025.07.2. Users are advised to upgrade to this version or later to address the security issue (JetBrains Advisory).