The vulnerability arises from a missing permission check in the Jenkins Contrast Continuous Application Security Plugin. It permits any user with Overall/Read rights to enumerate all configured Contrast metadata names, leading to unintended information disclosure. The weakness reflects improper access control and information leakage, affecting the confidentiality of plugin configuration data.

The flaw affects customers using Jenkins Project’s Contrast Continuous Application Security Plugin version 3.11 or earlier; no other versions or related products are known to be impacted.

The vulnerability can be exploited by any account that holds Overall/Read permission, generally associated with privileged or administrator roles. The attack vector is through the Jenkins web interface or API endpoints that expose metadata names; it is inferred from the description that an attacker would need access to the Jenkins instance with at least Overall/Read rights. The CVSS score is not specified, EPSS is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Nevertheless, any compromise of Overall/Read permissions—potentially via internal access or misconfiguration—could allow enumeration of sensitive configuration details.