CVE-2021-21624: Jenkins Role-Based Authorization Strategy

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Affected products

• Jenkins Role-Based Authorization Strategy: up to and including 3.1

Published 2021-03-18. Last modified 2026-06-17.