What is the CVSS score of CVE-2026-57293?

CVE-2026-57293 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Jenkins Gitee Plugin CVE-2026-57293

EUVD-2026-38774 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 jenkins

GHSA-jhcq-6wqp-qcfx

Authentication Bypass Jenkins Jenkins Gitee Plugin

4.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires a low-privilege authenticated Jenkins account (PR:L); only credential IDs - not secret values - are exposed, so C:L; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 16:24 vuln.today

CVSS changed

Jun 24, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 24, 2026 - 13:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.

AnalysisAI

Credential ID enumeration in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows authenticated attackers holding only global Item/Configure permission to bypass the intended per-job permission boundary and list credential IDs stored in Jenkins. The root cause is an incorrect permission check (CWE-862) that conflates global and job-scoped authorization, leaking credential identifiers without requiring job-level rights. No public exploit code exists and SSVC rates exploitation status as none; however, enumerated credential IDs can serve as reconnaissance for chained attacks targeting those credentials.

Technical ContextAI

The vulnerability resides in the Jenkins Gitee Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_gitee_plugin:*:*:*:*:*:*:*:*), a Jenkins CI/CD integration for the Gitee source-hosting platform. Jenkins implements a layered permission model in which global permissions and per-item (job-level) permissions are distinct authorization scopes. CWE-862 (Missing Authorization) manifests here as the plugin evaluating global Item/Configure permission as sufficient to authorize access to a credential ID enumeration endpoint that should require the caller to hold Item/Configure on a specific job. The plugin's form validation or API handler for listing credential IDs fails to correctly scope the permission check to the job context, allowing the global grant to satisfy a job-scoped gate.

RemediationAI

Upgrade the Jenkins Gitee Plugin to a version beyond 1288.v18b_deb_c9069b_ once the Jenkins Plugin Update Center publishes a remediated release; monitor the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3762%20(2) for the exact fix version, which is not confirmed in currently available data. As a compensating control, audit and restrict global Item/Configure permission to only those users who genuinely require it - reducing the set of accounts capable of triggering the incorrect check. Note that removing global Item/Configure from users may limit their ability to manage Jenkins items at the global scope, so validate the impact in a staging environment before applying to production. Credentials stored in Jenkins should also be audited so that any enumerated IDs can be rotated if suspicious access is detected.