Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. This has been patched in version 347.v32aeb0493c4f...

CVE-2025-58459

The Jenkins global-build-stats Plugin (version 322.v22f4db_18e2dd and earlier) is vulnerable to an authorization bypass because it fails to perform necessary permission checks on its REST API endpoints . This flaw allows attackers with Overall/Read permissions to enumerate graph IDs and access in...