Cross‑site request forgery in Jenkins Priority Sorter Plugin versions up to 936.v2c01c6b_84449 permits an attacker to overwrite the global job priority configuration. By forging authenticated requests, a malicious user can modify how jobs are scheduled across the entire Jenkins instance, potentially altering build order and resource allocation. This is a configuration‑control weakness (CWE‑352) that could lead to denial of service or unfair scheduling advantages.

The vulnerability affects the Jenkins Priority Sorter Plugin under the Jenkins Project. Versions 936.v2c01c6b_84449 and earlier are vulnerable; all other Jenkins plugins and core components are not directly affected.

No EPSS score has been published and the issue is not included in CISA KEV, suggesting limited public exploitation to date. However, the flaw requires an attacker to be able to send forged requests, typically meaning they possess an authenticated session or can hijack browser state. Given the potential to disrupt CI/CD pipelines and the lack of mitigations in the affected plugin, the risk level should be treated as moderate to high until a patched version is applied. The CVSS score of 4.3 indicates moderate severity.