CVE-2025-59475

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.527 and earlier Jenkins LTS versions 2.516.2 and earlier

Description Jenkins does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu, such as whether the Credentials Plugin is installed.

Recommendations Update Jenkins to a version later than 2.527. Update Jenkins LTS to a version later than 2.516.2.