The vulnerability allows a user with Item/Build permission to cancel another user's build by invoking the Jenkins build CLI with the -s flag. The command bypasses the normal Item/Cancel permission check, meaning the attacker can terminate any pending build regardless of ownership. This flaw does not affect code integrity or system access, but it can disrupt continuous integration workflows by removing scheduled work. The underlying weakness is an improper permission check (CWE-862).

Jenkins core from the Jenkins Project is affected in versions 2.579 and earlier in the mainline and LTS versions 2.568.2 and earlier. Systems running these releases are susceptible to the unchecked build CLI command, allowing cancellation of builds started by other users.

The CVSS score of 4.2 indicates moderate severity. No EPSS or KEV data are available, so widespread exploitation is not documented. The attack requires prior possession of Item/Build permission, so risk is limited to environments that grant this permission broadly. When exploited, the flaw can lead to denial of build progress for other users and potential workflow disruption.