A missing permission check in the Jenkins GitHub Branch Source Plugin allows users with Overall/Read permission to read the URLs of GitHub Enterprise servers that are configured in the global plugin configuration. The vulnerability results in the disclosure of potentially sensitive connection details that could be used to locate and possibly connect to corporate GitHub Enterprise instances.

The Jenkins Project’s GitHub Branch Source Plugin, versions prior to 1967.1969.v205fd594c821, is affected. Any Jenkins installation that uses this plugin and has GitHub Enterprise servers configured for use by the plugin is susceptible.

The issue is a pure privilege escalation of existing read rights; attackers need only possess a normal Read account, which is a common role. No additional exploitation steps are disclosed. The CVSS score is not provided, the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the ability to learn internal GitHub Enterprise URLs is a moderate to high risk to confidentiality, especially in environments where the URLs themselves reveal network topology or enable other attack vectors.