CVE-2025-64148
Medium · 4.3Jenkins Publish to Bitbucket Plugin is missing a permissions check
CVSS
4.3
EPSS
0.3%
Published
Oct 29, 2025
CISA due date
—
The record
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As of publication of this advisory, there is no fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:publish-to-bitbucket | 0 | No fix |
Related vulnerabilities
- CVE-2025-64149 Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check Also affects org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64150 Jenkins Publish to Bitbucket Plugin is missing a permissions check Also affects org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862
- CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful… CWE-862