CVE-2023-28668
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
- Record
CVE-2023-28668- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-281
- Updated
- 2026-11-02
CVE List
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
- Record
CVE-2023-28668- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-281
- Updated
- 2026-11-02
EUVDEUVD-2023-1178
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
- Record
EUVD-2023-1178- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-436g-2f92-cvhh
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).
Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.
This allows attackers to have greater access than they’re entitled to after the following operations took place:
A permission is granted to attackers directly or through groups.
The permission is disabled, e.g., through the script console.
Role-based Authorization Strategy Plugin 587.588.v850a_20a_30162 does not grant disabled permissions.
- Record
GHSA-436g-2f92-cvhh- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
OSV
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
- Record
CVE-2023-28668- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-436g-2f92-cvhh
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).
Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.
This allows attackers to have greater access than they’re entitled to after the following operations took place:
A permission is granted to attackers directly or through groups.
The permission is disabled, e.g., through the script console.
Role-based Authorization Strategy Plugin 587.588.v850a_20a_30162 does not grant disabled permissions.
- Record
GHSA-436g-2f92-cvhh- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:role-strategyMaven |
before 587.588.v850a | 587.588.v850a |
org.jenkins-ci.plugins:role-strategyMaven |
before 587.588.v850a_20a_30162, plus listed versions 1.1.21.1.32.1.02.102.11 Show 43 moreShow less2.122.132.142.152.162.2.02.3.02.3.12.3.22.4.02.5.02.5.12.6.02.6.12.7.02.8.02.8.12.8.22.9.03.03.13.1.13.2.0483.v17281966f5c3484.v8a_a_e4b_d785fd488.v0634ce149b_8c501.v88fe53d65c80506.v13f908ee1fc9508.v2a_f05b_05e9d8510.v909834359ec2521.vcf7a_3a_8dde42526.v859673312a_14530.ved5445d4875a_546.ve16648865996548.vb_60076577ec7552.v14cb_85499b_89555.v8d194cc85b_30561.v9846c7351a_41562.v44e9a_e828d0e569.v7476f8e4fe29575.v4d286a_03e6d7584.vf8e515397ecd587.v2872c41fa_e51 |
587.588.v850a_20a_30162 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28668 is a critical vulnerability (CVSS 9.8) in Jenkins Role-based Authorization Strategy, published March 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in org.jenkins-ci.plugins:role-strategy 587.588.v850a.