JetBrains IDE Services
CVE-2025-58334
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege IDE Services user
-
DeliverySend crafted role-assignment request
-
ExploitBypass missing authorization check
-
ExecutionSelf-assign high-privileged role
-
ImpactControl IDE Services platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an existing authenticated account on the JetBrains IDE Services instance (PR:L) but only a low-privilege one - the flaw lets that user assign a high-privileged role to themselves via the role-assignment feature because authorization is not enforced (CWE-862). No user interaction is needed (UI:N) and it is network-reachable (AV:N). The limiting factors are that the attacker must already have valid low-privilege credentials/access to an IDE Services deployment and the instance must be running a version before 2025.5.0.1086 or 2025.4.2.2164; there is no public exploit and EPSS is 0%, so realistic risk is highest for instances with self-service or broadly-granted low-tier accounts. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity privilege escalation that an already-authenticated low-privilege user can trigger without victim interaction, yielding full confidentiality/integrity/availability impact once the attacker grants themselves a high-privileged role. This is consistent with the CWE-862 (Missing Authorization) root cause and the description. However, the exploitation-probability signals are all quiet: EPSS is 0.00% (0th percentile), there is no CISA KEV listing, and no public POC is referenced - so this is currently 'no public exploit identified at time of analysis.' The picture is a genuinely serious flaw for organizations running IDE Services (any registered low-privilege account can become an administrator), but with no evidence of real-world exploitation and a limited deployment footprint, it is a patch-promptly issue rather than an emergency. Note the CVSS C:H/I:H/A:H is somewhat generous - the concrete described impact is a role/authorization takeover of the IDE Services platform; downstream availability impact is inferred rather than explicitly stated by the vendor. |
| Exploit ScenarioDerived | A user with a low-privilege account on a JetBrains IDE Services instance sends a crafted request to the role-assignment functionality and grants their own account an administrative/high-privileged role, because the server fails to verify the caller is authorized to make that assignment. With that role they gain full control over the IDE Services deployment and any secrets, license/plugin distribution, and configuration it governs. No public exploit code is referenced and EPSS is 0%, so exploitation would currently be opportunistic/insider rather than mass-automated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 26, 2026
Privilege escalation in JetBrains IDE Services lets an already-authenticated, low-privileged user grant themselves a high-privileged role through the role-assignment feature, because authorization checks are missing on that operation (CWE-862). Any deployment running a version before 2025.5.0.1086 or before 2025.4.2.2164 is affected; the attacker needs valid low-tier credentials and network reachability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) but no victim interaction. No public exploit code exists and EPSS is 0.00% (0th percentile), so exploitation is not confirmed actively exploited (CISA KEV not listed); realistic exposure is concentrated in instances that grant broad or self-service low-privilege accounts. Vendor-released patches: 2025.5.0.1086 and 2025.4.2.2164.
Earlier versions of this analysis (1)
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
RemediationAI
Upgrade JetBrains IDE Services to 2025.5.0.1086 or 2025.4.2.2164 (matching your release branch) - these are the vendor-released fixed versions named in the CVE, and the fix is documented on JetBrains' fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/. Where immediate upgrade is not possible, compensating controls should focus on shrinking the population of low-privilege accounts that can reach the role-assignment path: suspend or disable self-service account provisioning and require administrative approval for new IDE Services accounts, since the assessed prerequisite is that the attacker already holds valid low-privilege credentials; the trade-off is added onboarding friction and manual administration overhead. Audit and reconcile existing role assignments and account inventory for any role escalation that occurred before patching - a successful exploit leaves the attacker with a persistent high-privileged role, so detection requires reviewing role-change history rather than relying on the patch alone. Restrict network access to the IDE Services administrative interface to trusted management networks or VPN, which reduces the AV:N exposure but does not remove the risk from internal or compromised accounts. Because the missing authorization is on the role-assignment operation itself, disabling or blocking that administrative endpoint at a reverse proxy would prevent exploitation but also break legitimate role administration, so it is viable only as a short-term emergency measure. No public exploit code exists and EPSS is 0.00%, so emergency hotfixing may be prioritized behind internet-facing issues, but the absence of exploit code is not a guarantee of safety.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains IDE Services is the centralized management layer that provisions and governs JetBrains IDE fleets, including user identity, licensing, and role-based access control across an organization's developer tooling. The flaw is classified as CWE-862 (Missing Authorization): the role-assignment functionality does not verify that the requesting principal holds the permissions required to grant the target role, so a request from any authenticated low-privilege account is processed as though authorized. This is a server-side authorization enforcement gap rather than a memory-safety or injection defect, meaning the underlying technology is the service's REST/administrative API and its permission model. The CPE strings (cpe:2.3:a:jetbrains:ide_services:*:*:*:*:*:*:*:*) confirm that all unpatched releases of the IDE Services product line below the fixed builds are in scope, and the CVSS scope is Unchanged (S:U), so the escalated identity operates within the same security authority as the original account. Because the vector is AV:N/AC:L/PR:L/UI:N, the attack is a straightforward authenticated HTTP request with no timing, race, or user-interaction requirement - a single successful call to the role-assignment endpoint is sufficient to obtain the higher privilege level.
Know when Ide Services gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-privilege user (PR:L) can self-escalate over the network with no interaction; gaining a high-privileged role yields full platform C/I/A control, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
Executive ViewAI
JetBrains IDE Services, the platform that centralizes user and role management for enterprise JetBrains tooling, contains an authorization flaw that allows any user holding even basic credentials to promote themselves to an administrative role without any victim interaction. Because the affected versions sit in the path of how teams provision developer access, a single compromised or self-service account could yield control over project data, build secrets, and developer identities across the organization. Leadership should treat this as a high-priority identity and access risk, particularly in environments that issue broad low-privilege accounts or expose the service beyond a trusted network.
Apply vendor patch. Until the upgrade to 2025.5.0.1086 or 2025.4.2.2164 is complete, limit network exposure of IDE Services to trusted networks, suspend or tightly govern self-service and broad low-privilege account provisioning, and monitor role-assignment activity for unexpected privilege grants.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB