Jenkins Missing Permission Check

GHSA-565r-pf5q-45v6 · BIT-jenkins-2025-31720 · CVE-2025-31720

Published Apr 2, 2025 · Modified Feb 4, 2026

Description

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

Jenkins 2.504, LTS 2.492.3 requires Computer/Extended Read permission to copy an agent.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-31720
WEB https://github.com/jenkinsci/jenkins/commit/bf32018bf075c06e5df649583557c82d42d8bb5c
WEB https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3512

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes