Threats tagged 'bit-jenkins-2026-70429'

Jenkins versions 2.575 and earlier, including LTS 2.568.1 and earlier, have an inconsistent handling of case-insensitivity in user and group names. This flaw allows attackers who can create new users or groups with names that case-insensitively match existing ones to impersonate those users or gain their permissions under certain conditions. The vulnerability is identified as CWE-178 and has a high severity with a CVSS score of 8.1.