Jenkins User Profile Dropdown Menu Permits Unauthorized Information Exposure

CVE-2025-59475

What is CVE-2025-59475?

Jenkins versions 2.527 and earlier, as well as LTS version 2.516.2 and earlier, fail to implement a necessary permission check for the user profile dropdown menu. This oversight enables authenticated users lacking Overall/Read permissions to inadvertently gain access to sensitive information regarding the Jenkins configuration. Specifically, they can enumerate available options within this menu, revealing whether critical plugins such as the Credentials Plugin are installed, thereby potentially exposing the environment to further risks.

References