Jenkins Themis Plugin versions 1.4.1 and earlier lack a permission check on an HTTP endpoint, allowing attackers with Overall/Read permission to connect to arbitrary URLs. The endpoint also does not require POST requests, introducing a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.