TeamCity Exposure Turns Project Visibility into Build Authority

TeamCity presents build results, agents, project settings, and user administration through one web application. The page is useful to developers, but a project administrator or system administrator can change build configuration, handle credentials, and influence what runs on an agent. The authorization mode determines whether a user with access to one project can reach another.

A count-only ZoomEye search on 2026-10-30 returned 8 matches for app="TeamCity" and 3,016 for title="TeamCity" between 06:41 and 06:42 China Standard Time. The product fingerprint is much narrower than the title, which is a reminder that a title can describe a documentation page or a different layout. Neither count proves that the matched host is a live TeamCity server with weak permissions.

Choose the authorization model deliberately

TeamCity documentation describes simple and per-project authorization modes.…