What is the CVSS score of CVE-2026-53439?

CVE-2026-53439 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Jenkins CVE-2026-53439

EUVD-2026-36023 MEDIUM

Missing Authorization (CWE-862)

2026-06-10 jenkins

GHSA-g28p-6mcc-v4rv

Authentication Bypass Jenkins Red Hat

4.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:46 vuln.today

CVSS changed

Jun 10, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 10, 2026 - 13:06 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views".

AnalysisAI

Missing authorization checks in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier) expose user-specific configuration data to any authenticated user holding the Overall/Read permission. Authenticated low-privilege users can query the timezone setting of any Jenkins user account and enumerate the names of views configured within other users' 'My Views' personal dashboards, constituting an information disclosure weakness. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, placing real-world risk in the low-moderate tier primarily relevant to multi-tenant or shared Jenkins deployments.

Technical ContextAI

Jenkins implements a role-based access control (RBAC) model where Overall/Read is the baseline permission granted to virtually all authenticated users. CWE-862 (Missing Authorization) describes the root cause: server-side endpoints servicing user profile metadata and personal view enumeration fail to verify that the requesting user has rights to access another user's data before returning results. The affected functionality spans at least two internal surfaces - user timezone resolution (likely tied to user profile API calls) and 'My Views' view name listing (personal dashboard scoping). The CPE string cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:* confirms this affects the core Jenkins project across all editions prior to the patched releases. No third-party plugin is involved; the flaw resides in Jenkins core.

RemediationAI

Vendor-released patches are available: upgrade Jenkins weekly to version 2.568 or later, or upgrade Jenkins LTS to version 2.555.3 or later. Both fix versions are confirmed by the EUVD entry EUVD-2026-36023 and the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3713. If immediate upgrade is not feasible, a compensating control is to restrict Overall/Read permission to only explicitly trusted users by tightening the Jenkins authorization strategy (e.g., switching from 'Anyone can do anything' or 'Legacy mode' to Matrix-based or Project-based authorization). Note that restricting Overall/Read broadly may break pipeline visibility for some users. No workaround fully eliminates the risk short of patching. The oss-security disclosure is available at https://seclists.org/oss-sec/2026/q2/867 for additional context.