JetBrains TeamCity CVE-2025-67740

Exploitation requires network reachability to a JetBrains TeamCity server running a version before 2025.11 that has a GitHub App integration configured (i.e., a GitHub App token must exist for its metadata to be exposed). The impact is bounded to disclosure of that token's metadata, not the token secret, and only confidentiality is affected. The practical limiting factor is the GitHub App integration being configured; instances without GitHub App connections have nothing to leak. The CVSS vector claims no authentication (PR:N), but because the underlying issue is improper authorization (CWE-863), defenders should confirm whether anonymous access is actually sufficient on their deployment.

This is a moderate-severity information disclosure flaw (CVSS 5.3) that is unlikely to be a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity issue requiring no privileges or user interaction, but the impact is limited to confidentiality (C:L) with no integrity or availability effect - consistent with exposure of GitHub App token metadata rather than the token secret or code execution. The EPSS score of 0.22% (12th percentile) signals very low probability of exploitation in the wild, and there is no public exploit identified at time of analysis and no CISA KEV listing, so all exploitation signals align toward low real-world urgency. One point of tension: the vector asserts PR:N (unauthenticated) while the root cause is improper access control / improper authorization (CWE-863), which typically implies some authenticated but under-privileged context; the published vector should be treated as the authoritative claim since it comes from the JetBrains CNA, but defenders operating hardened TeamCity instances should verify whether truly anonymous access is required. No SSVC decision data was provided in the input.

A remote attacker with network access to a TeamCity server (before 2025.11) issues requests that, due to improper access control, return metadata associated with a configured GitHub App token that the requester should not be able to view. The attacker uses this leaked metadata for reconnaissance of the CI/CD-to-GitHub integration. No public exploit code is known, and the disclosed data is metadata - not the token secret itself - limiting direct follow-on impact.