{"id":"CVE-2026-57292","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-57292","summary":"Jenkins Gitee Plugin has a cross-site request forgery vulnerability","details":"Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\nAdditionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nGitee Plugin 1292.v2559f2f3f2c0 requires the appropriate permissions in the affected HTTP endpoints, and requires POST requests.","published":"2026-06-24T15:31:47Z","modified":"2026-09-25T19:15:04.588169432Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:gitee","fixedVersion":"1292.v2559f2f3f2c0"}],"fix":{"url":"https://github.com/jenkinsci/gitee-plugin/pull/199","label":"jenkinsci/gitee-plugin#199"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57292"},{"type":"WEB","url":"https://github.com/jenkinsci/gitee-plugin/pull/199"},{"type":"WEB","url":"https://github.com/jenkinsci/gitee-plugin/commit/2559f2f3f2c02659d9abe5ab3d66c13cef9278dc"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/gitee-plugin"},{"type":"WEB","url":"https://github.com/jenkinsci/gitee-plugin/releases/tag/1292.v2559f2f3f2c0"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3762%20(1)"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-25T19:15:04.588169432Z"}}