Missing Permission Check in Jenkins Allows Unauthorized Access to Encrypted Passwords

CVE-2025-67636

What is CVE-2025-67636?

A missing permission check in Jenkins versions 2.540 and earlier, including LTS version 2.528.2 and earlier, permits users with merely View/Read permissions to access sensitive information stored as encrypted passwords within views. This vulnerability can lead to unauthorized exposure of critical credentials, putting various integrations and configurations at risk of exploitation.

References