CVE-2025-68267
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: JetBrains s.r.o.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jetbrains | teamcity | to 2025.11.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-272 | The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in JetBrains TeamCity versions before 2025.11.1 involves excessive privileges being possible because the system stored a GitHub personal access token instead of an installation token. This means that the token used had broader permissions than necessary, potentially allowing unauthorized access or actions.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker or unauthorized user could gain excessive privileges due to the use of a GitHub personal access token with broader permissions. This could lead to unauthorized access to data or modification of information within TeamCity, potentially compromising confidentiality and integrity.