GitHub Advisoryadvisory · Maven

GHSA-fq56-wvv2-p8jf Jenkins Priority Sorter Plugin has a CSRF vulnerability

MEDIUM Published 2026-06-24 Modified 2026-09-25 Official page ↗
Aliases
CVE-2026-57290
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:PrioritySorter
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2026-09-25

Affected packages

• Maven org.jenkins-ci.plugins:PrioritySorter: < 936.937.v5581d0b → fixed in 936.937.v5581d0b

Description

Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration. This allows attackers to overwrite the global job priority configuration. Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

Related

Alias · CVE (1)

  • CVE-2026-57290 A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References