The Jenkins External Workspace Manager Plugin up to version 1.4.1 suffers from a permission check vulnerability (CWE-862). Specifically, version 1.4.0 and earlier do not perform any permission checks when providing access to externally-managed workspaces via the workspace browser, while version 1.4.1 performs an improper permission check. This flaw allows attackers with Overall/Read permission to read files in workspaces they are not authorized to access, potentially exposing sensitive information. The vulnerability is tracked as CVE-2026-70436 with a CVSS 3.1 base score of 4.3 (medium severity). No official patch or remediation level has been indicated in the available data.

Attackers with Overall/Read permission on Jenkins can exploit this vulnerability to read files in workspaces outside their authorization scope. This could lead to unauthorized disclosure of sensitive data stored in those workspaces. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Overall/Read permissions to trusted users only to limit exposure. Monitor Jenkins plugin updates for a patch addressing this vulnerability.