CVE-2025-68267

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-272

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-682686.1In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page CVE-2025-682695.4In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH CVE-2025-68279.8A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part CVE-2025-682709.9The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole us CVE-2025-6827110.0OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1 CVE-2025-682727.5Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2 CVE-2025-682735.3Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in ver CVE-2025-682747.5SIPGO is a library for writing SIP services in the GO language. Starting in version 0.3.0 and prior to version 1.0.0-alpha-1, a nil pointer CVE-2025-682754.8ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages CVE-2025-682765.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unpr CVE-2025-682775.0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link CVE-2025-682788.8Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way all