The vulnerability arises from missing permission checks in Jenkins versions 2.567 and earlier and LTS 2.555.2 and earlier. A user with Overall/Read permission can query the web interface to learn the configured timezone of other users and enumerate the names of other users’ "My Views". This allows the attacker to obtain sensitive user configuration data that should not be publicly accessible.

The affected software is Jenkins Project Jenkins. The vulnerability applies to all Jenkins releases up to and including version 2.567 and to LTS releases up to and including 2.555.2. Users running these versions are susceptible.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation in the wild to date. However, since the defect can be triggered by any user with Overall/Read permission and requires no further conditions, the risk is non‑negligible. The attack vector is likely remote, as the flaw is accessed through the Jenkins web UI. The provided CVSS score is not available, so the exact severity cannot be quantified from the data presented.