In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled

In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.

In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles

In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions

In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.

In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.

In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions

A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.

In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.