Jenkins GitHub Branch Source Plugin versions up to 1967.1969.v205fd594c821 have a missing permission check in a form validation method. This flaw allows users with Overall/Read permission to perform a connection test using attacker-specified URLs and GitHub App credentials. The issue is fixed in version 1967.1969.v205fd594c821, which requires Overall/Manage permission for the connection test.