A missing permission check in the Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 allows downstream builds triggered by the build step to be canceled even when the initiating build’s authentication lacks Item/Cancel permission on the downstream job. The flaw permits an attacker who can execute a pipeline build containing a build step that targets another job to cancel that downstream job, effectively removing the ability of the downstream job to complete. This represents an authorization weakness, classified as CWE-862.

Affected versions are Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and all earlier releases. The vulnerability impacts any Jenkins instance running those plugin versions, specifically when users trigger downstream builds using the build step.

The CVSS score of 5.4 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a Jenkins user with permission to initiate pipeline jobs, since the build step must be executed within an authorized build context. An attacker does not need higher privileges on the downstream job, only the ability to run a pipeline that calls the vulnerable build step.