The Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier contain a missing permission check vulnerability. This flaw permits users who have Overall/Read permission in Jenkins to initiate connections to URLs specified by an attacker, using GitHub App credentials also controlled by the attacker. The vulnerability arises from insufficient access control in the plugin's handling of GitHub App authentication and URL connections.

Attackers with Overall/Read permission can misuse the plugin to connect to attacker-controlled URLs with attacker-supplied GitHub App credentials. This could potentially lead to unauthorized interactions with external systems or services via the Jenkins environment. However, the exact impact depends on the attacker's ability to leverage these connections and the context of the Jenkins deployment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until an official fix is released, restrict Overall/Read permissions to trusted users only to limit potential exploitation. Monitor Jenkins plugin updates and apply any official fixes promptly once available.