CVE-2025-58459: Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

September 3, 2025 (updated November 5, 2025)

Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

This has been patched in version 347.v32a_eb_0493c4f.

References

github.com/advisories/GHSA-gm8g-fh49-qq6v
github.com/jenkinsci/global-build-stats-plugin
github.com/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138
nvd.nist.gov/vuln/detail/CVE-2025-58459
www.jenkins.io/security/advisory/2025-09-03/

Code Behaviors & Features

Detect and mitigate CVE-2025-58459 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →