CVE-2026-48923
Received Received - Intake
Permission Check Bypass in Jenkins AppSpider Plugin

Publication date: 2026-05-27

Last updated on: 2026-05-28

Assigner: Jenkins Project

Description
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-28
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-48923
EUVD
EUVD-2026-32514
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jenkins appspider to 1.0.18 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Jenkins AppSpider Plugin version 1.0.17 and earlier contains a vulnerability where it does not perform a permission check in a method that implements form validation. This flaw allows attackers who have Overall/Read permission to connect to a URL specified by the attacker.

Impact Analysis

This vulnerability could allow an attacker with limited permissions (Overall/Read) to make the Jenkins server connect to an attacker-controlled URL. This could potentially be used to perform unauthorized actions such as information disclosure, triggering unwanted network connections, or facilitating further attacks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart