The vulnerability is a missing permission check in Jenkins releases 2.567 and earlier, and LTS 2.555.2 and earlier. It allows an attacker who has Item/Cancel permission but lacks Item/Read permission to cancel queue items they are not permitted to view. This can be used to disrupt continuous integration pipelines or manipulate build queues, effectively providing a privilege escalation that impairs the availability and integrity of the build system.

Jenkins Project Jenkins versions 2.567 and all earlier releases, as well as the Long Term Support line 2.555.2 and earlier, are affected. Administrators using these releases should verify the installed version and plan to upgrade.

EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The exploitability requires the attacker to possess Item/Cancel authority, suggesting an internal or easily compromise‑able threat scenario. An attacker can cancel queued builds that they cannot otherwise see, potentially disrupting services or creating denial‑of‑service conditions. As no public exploit code is known, the risk is considered moderate, but organizations that use Jenkins without tightly controlling Item/Cancel permissions should treat this as high severity.