This vulnerability in Jenkins arises from a missing permission check that permits users who have the Item/Cancel permission but lack the Item/Read permission to cancel queue items they cannot view. The affected versions include Jenkins 2.567 and earlier, and LTS 2.555.2 and earlier. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and low privileges required, with no impact on confidentiality or availability but limited impact on integrity. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild.

Attackers with Item/Cancel permission but without Item/Read permission can cancel queue items they are not authorized to see. This could disrupt build queue operations by unauthorized cancellation of jobs, impacting integrity of the queue management. There is no impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the Jenkins vendor advisory for current remediation guidance. Until a fix is available, review and restrict Item/Cancel permissions carefully to trusted users only to limit potential exploitation.