A missing permission check in the Jenkins Script Security Plugin (versions 1399.ve6a_66547f6e1 and earlier) allows any user with Overall/Read permission to enumerate both pending and approved Script Security classpaths. This behavior results in the disclosure of internal configuration information. Based on the description, it is inferred that the listed classpaths may reveal file system locations and settings relevant to the Jenkins environment.

The affected software is the Jenkins Project’s Script Security Plugin. All installations using version 1399.ve6a_66547f6e1 or earlier are impacted.

The CVSS base score of 4.3 indicates a moderate severity level. The EPSS score of < 1% reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires a user with Overall/Read permission, which is commonly granted, the attack surface is relatively broad; however, the consequence remains limited to the disclosure of internal classpath data. The likely attack vector is via the Jenkins web interface or API, but this inference is made from the requirement of web‑based permissions and not explicitly stated in the description.