A missing permission check in the Jenkins Zowe zDevOps Plugin allows an attacker who already has Overall/Read permission to connect to an arbitrary URL using attacker‑specified credential IDs. Because the plugin does not verify that the credential IDs used belong to the requester, the attacker can access any credential stored in the Jenkins credential store, resulting in the theft of potentially sensitive credentials. The weakness is a classic permission‑control failure (CWE-862).

All users of the Jenkins Zowe zDevOps Plugin versions up to and including 1.1.3.50.ve350c9b_450b_1 are affected. No other versions or products are listed as impacted.

The CVSS score of 4.2 places this vulnerability in the moderate severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild. The attacker must first gain the Overall/Read permission within a Jenkins instance, which is required to supply credential IDs to the plugin. Consequently, the attack surface is limited to environments where such permissions have been granted broadly. If an attacker can also obtain credential IDs through other means, this weakness can be leveraged to exfiltrate any stored credentials.