MEDIUM
CVE-2026-57304
CVSS
5.4
Description
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
Summary dbcve.org
The Assembla Plugin for Jenkins lacks proper permission enforcement on an API endpoint. Users with basic Overall/Read permission (the lowest privilege level in Jenkins) can trigger the plugin to connect to arbitrary URLs with attacker-controlled credentials, enabling potential SSRF, data exfiltration, or lateral movement from the Jenkins server.
Mitigation
Upgrade to Assembla Plugin version 1.5 or later which implements proper permission checks requiring Overall/Administer access for sensitive operations.
Weakness (CWE)
CWE-862
Missing Authorization
EPSS Score
0.25%
Probability of exploitation in next 30 days
17.4th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.