A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
{
"github_reviewed": true,
"github_reviewed_at": "2025-12-10T20:10:34Z",
"cwe_ids": [
"CWE-862"
],
"nvd_published_at": "2025-12-10T17:15:56Z",
"severity": "MODERATE"
}