Missing permission check in Jenkins External Workspace Manager Plugin (CVE-2026-70436)

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (versions 1.4.0 and earlier) or performs an improper permission check (version 1.4.1) when providing access to externally-managed workspaces through the workspace browser. This allows attackers with Overall/Read permission to read files in workspaces they are not authorized to access. Affected versions: - 1.4.1 and earlier We recommend updating to: 1.4.2. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/438 Details: https://vuln.today/cve/CVE-2026-70436