CVE-2025-67740: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-67740 is an improper access control vulnerability in JetBrains TeamCity that could expose GitHub App token metadata to unauthorized parties. It affects all versions of JetBrains TeamCity before 2025.11 and was published on December 11, 2025. The vulnerability is classified as CWE-863 (Incorrect Authorization) and carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, though ENISA's EU Vulnerability Database scores it at 2.7 with a high-privilege requirement (JetBrains Advisory, Red Hat CVE).

The root cause is incorrect authorization (CWE-863) in TeamCity's handling of GitHub App integration, where access controls on token metadata endpoints are insufficiently enforced. Depending on the scoring source, the vulnerability may be exploitable either without authentication (CVSS AV:N/PR:N per NVD) or only by high-privileged users (PR:H per ENISA/EUVD), suggesting ambiguity in the exact preconditions. In either case, an attacker or privileged user can retrieve metadata associated with configured GitHub App tokens — such as token identifiers or configuration details — without proper authorization checks (JetBrains Advisory, Red Hat CVE).

Successful exploitation results in a low confidentiality impact, exposing partial metadata about GitHub App tokens configured within TeamCity. This could reveal information about GitHub integrations (e.g., token identifiers or app configuration details) that might assist an attacker in further targeting the CI/CD pipeline or associated GitHub repositories. Integrity and availability are not affected, and the scope of impact is limited to the TeamCity instance itself (Red Hat CVE, JetBrains Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is extremely low at 0.000020, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Red Hat CVE, JetBrains Advisory).

JetBrains has released a fix in TeamCity version 2025.11; upgrading to this version or later is the recommended remediation. As interim measures, organizations should restrict high-privilege user accounts, apply the principle of least privilege, and audit access to GitHub App integration settings within TeamCity. Monitoring user activity logs for unexpected access to token configuration endpoints is also advisable (JetBrains Advisory).

The vulnerability received limited community attention, with automated tracking by vulnerability aggregators such as Vulners, VulDB, and CIRCL's vulnerability lookup service. Red Hat also tracked the CVE for potential impact on their products. No notable researcher commentary or significant media coverage beyond routine security digest mentions has been identified (Red Hat CVE).