CVE-2025-24401: Jenkins Folder-based Authorization Strategy Plugin Allows Disabled Permissions to be Granted
Summary
CVE-2025-24401: Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin. Affects io.jenkins.plugins:folder-auth versions < 217.vd5b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Folder-based Authorization Strategy Plugin is a critical component for managing access control within Jenkins, a widely used open-source automation server. This plugin allows administrators to define permissions for folders and their contents, enabling fine-grained access control. However, the plugin has a vulnerability that can lead to unauthorized access if permissions are not properly verified, potentially compromising the security of Jenkins installations.
Vulnerability Detail
The vulnerability in the Jenkins Folder-based Authorization Strategy Plugin arises from its failure to verify that permissions configured to be granted are actually enabled. This oversight can allow users who were previously granted permissions, such as Overall/Manage, to regain access to functionalities they should no longer have. The issue is particularly concerning because it can lead to unauthorized actions being performed by users who should not have access, thus posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can manually review and adjust user permissions to ensure that no unauthorized access is granted until the plugin is updated. Regular audits of user permissions can help mitigate the risk until a permanent fix is applied.
Conclusion
The Jenkins Folder-based Authorization Strategy Plugin has a vulnerability that can allow disabled permissions to be granted, posing a security risk. It is crucial for users of this plugin to update to the patched version to mitigate potential unauthorized access. Regular audits and the use of tools like Vulert can help maintain security in open-source projects.
See every vulnerability recorded for io.jenkins.plugins:folder-auth →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow unauthorized users to access sensitive functionalities within Jenkins, potentially leading to data breaches or unauthorized changes.
Yes, the issue is addressed in version 217.vd5b_18537404 and later of the Jenkins Folder-based Authorization Strategy Plugin.
If an immediate update is not possible, review and adjust user permissions manually to prevent unauthorized access until the plugin can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:folder-auth.
