Ide Services
Monthly
Privilege escalation in JetBrains IDE Services lets an already-authenticated, low-privileged user grant themselves a high-privileged role through the role-assignment feature, because authorization checks are missing on that operation (CWE-862). Any deployment running a version before 2025.5.0.1086 or before 2025.4.2.2164 is affected; the attacker needs valid low-tier credentials and network reachability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) but no victim interaction. No public exploit code exists and EPSS is 0.00% (0th percentile), so exploitation is not confirmed actively exploited (CISA KEV not listed); realistic exposure is concentrated in instances that grant broad or self-service low-privilege accounts. Vendor-released patches: 2025.5.0.1086 and 2025.4.2.2164.
Privilege escalation in JetBrains IDE Services lets an already-authenticated, low-privileged user grant themselves a high-privileged role through the role-assignment feature, because authorization checks are missing on that operation (CWE-862). Any deployment running a version before 2025.5.0.1086 or before 2025.4.2.2164 is affected; the attacker needs valid low-tier credentials and network reachability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) but no victim interaction. No public exploit code exists and EPSS is 0.00% (0th percentile), so exploitation is not confirmed actively exploited (CISA KEV not listed); realistic exposure is concentrated in instances that grant broad or self-service low-privilege accounts. Vendor-released patches: 2025.5.0.1086 and 2025.4.2.2164.