CVE-2021-21623: Jenkins Matrix Authorization Strategy

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Affected products

• Jenkins Matrix Authorization Strategy: up to and including 2.6.5

Published 2021-03-18. Last modified 2026-06-17.