All vulnerabilities
CVE-2026-57293GHSA-jhcq-6wqp-qcfx

org.jenkins-ci.plugins:gitee: Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs

Jenkins Project org.jenkins-ci.plugins:giteemavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1292.v2559f2f3f2c0Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1292.v2559f2f3f2c0org.jenkins-ci.plugins:gitee, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>gitee</artifactId><version>1292.v2559f2f3f2c0</version></dependency>
  • 1292.v2559f2f3f2c0org.jenkins-ci.plugins:gitee, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>gitee</artifactId><version>1292.v2559f2f3f2c0</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier does not correctly perform a permission check in an HTTP endpoint.

This allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Gitee Plugin 1292.v2559f2f3f2c0 requires Overall/Administer permission.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:gitee, maven< 1292.v2559f2f3f2c0GitHub
  • Jenkins Gitee Pluginaffected: all versions through 1288.v18b_deb_c9069b_CVE List
  • org.jenkins-ci.plugins:gitee, Mavenfrom first release, fixed in 1292.v2559f2f3f2c0OSV
  • org.jenkins-ci.plugins:gitee, Maven1.0.11OSV
  • org.jenkins-ci.plugins:gitee, Maven1.0.12OSV
  • org.jenkins-ci.plugins:gitee, Maven1.0.13OSV
  • org.jenkins-ci.plugins:gitee, Maven1.0.14OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.1OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.10OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.11OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.12OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.13OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.14OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.15OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.2OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.3OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.4OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.5OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.7OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.8OSV
  • org.jenkins-ci.plugins:gitee, Maven1.1.9OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.1OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.2OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.3OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.4OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.5OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.6OSV
  • org.jenkins-ci.plugins:gitee, Maven1.2.7OSV
  • org.jenkins-ci.plugins:gitee, Maven1164.v92b_911c15f28OSV
  • org.jenkins-ci.plugins:gitee, Maven1165.vd01443918414OSV
  • org.jenkins-ci.plugins:gitee, Maven1170.v3d4640b_34233OSV
  • org.jenkins-ci.plugins:gitee, Maven1189.v6cb_10c9d63b_8OSV
  • org.jenkins-ci.plugins:gitee, Maven1190.v317d91b_3a_4e2OSV
  • org.jenkins-ci.plugins:gitee, Maven1195.ve7a_e26d4a_898OSV
  • org.jenkins-ci.plugins:gitee, Maven1197.v2a_b_30a_0982b_7OSV
  • org.jenkins-ci.plugins:gitee, Maven1198.vf35a_c423421eOSV
  • org.jenkins-ci.plugins:gitee, Maven1201.vc0f481dff802OSV
  • org.jenkins-ci.plugins:gitee, Maven1204.v4635f4272c96OSV
  • org.jenkins-ci.plugins:gitee, Maven1224.v843da_c08c504OSV
  • org.jenkins-ci.plugins:gitee, Maven1232.v1f6eca_6f587eOSV
  • org.jenkins-ci.plugins:gitee, Maven1245.vb_39c7f51d6b_2OSV
  • org.jenkins-ci.plugins:gitee, Maven1246.va_96d8b_79c02fOSV
  • org.jenkins-ci.plugins:gitee, Maven1247.v3cf071d5ff46OSV
  • org.jenkins-ci.plugins:gitee, Maven1250.vef5eeda_60678OSV
  • org.jenkins-ci.plugins:gitee, Maven1251.vb_37e0d6e1b_e7OSV
  • org.jenkins-ci.plugins:gitee, Maven1252.v891b_4e5f0303OSV
  • org.jenkins-ci.plugins:gitee, Maven1253.vb_5564dd738c8OSV
  • org.jenkins-ci.plugins:gitee, Maven1255.v1b_42e96a_378b_OSV
  • org.jenkins-ci.plugins:gitee, Maven1256.ve06b_0354a_c88OSV
  • org.jenkins-ci.plugins:gitee, Maven1257.v94e12c8783d7OSV
  • org.jenkins-ci.plugins:gitee, Maven1258.v1a_3914c28c90OSV
  • org.jenkins-ci.plugins:gitee, Maven1259.va_7b_c7a_46a_79dOSV
  • org.jenkins-ci.plugins:gitee, Maven1260.v88b_b_167e8cb_7OSV

References 6