Jenkins Gitee Plugin CVE-2026-57293

Exploitation requires an authenticated Jenkins account holding global Item/Configure permission while explicitly lacking Item/Configure permission on any individual job - a specific permission configuration that may arise in environments where users are granted broad global rights without fine-grained job-level scoping. The CVSS PR:L confirms that unauthenticated exploitation is not possible; a valid Jenkins account is required. The Jenkins Gitee Plugin must be installed and credentials must be stored in Jenkins for the enumeration to yield useful information. Limiting factors: only credential IDs (not credential values or secrets) are disclosed; the attack is not automatable per SSVC, meaning bulk or scripted mass exploitation against many instances is not feasible; and the permission split between global and per-job Item/Configure must exist, which is a non-default condition in well-managed Jenkins deployments.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the limited blast radius: the attack is network-reachable and low-complexity but requires an authenticated low-privilege account, and the impact is confined to confidentiality of credential IDs only - not credential values or secrets. SSVC reinforces the low urgency: exploitation is rated none, the attack is not automatable, and technical impact is partial. No EPSS score is available in the provided data, but absence of active exploitation and the non-automatable nature suggest a low real-world probability of opportunistic exploitation. The primary residual risk is reconnaissance value: credential IDs can be used to craft more targeted attacks against Jenkins credential bindings elsewhere. No data conflicts are present across the available signals.

An authenticated Jenkins user granted global Item/Configure permission - but with no job-level Item/Configure rights - sends a crafted API or form-validation request to the Gitee Plugin credential selection endpoint. The plugin's incorrect permission check passes the request using the global grant alone, returning a list of credential IDs configured in Jenkins. The attacker records the exposed IDs and uses them as reconnaissance to identify high-value credentials for subsequent targeted exploitation.