{"action":"Upgrade org.jenkins-ci.plugins:job-import-plugin to 143.145.v48f9a or later.","affected":[{"fixed":"143.145.v48f9a","introduced":"0"}],"component":"org.jenkins-ci.plugins:job-import-plugin","cve_ids":["CVE-2026-48926"],"ecosystem":"Maven","epss":0.00171,"exploited":false,"fixed_versions":["143.145.v48f9a"],"ghsa_id":"GHSA-p8jh-4p5p-2rfp","id":"tcs_01M5N970DCXA957PJR59VNN4BC","modified_at":"2026-07-01T20:11:28.912410Z","published_at":"2026-05-27T15:33:27Z","references":["https://osv.dev/vulnerability/GHSA-p8jh-4p5p-2rfp","https://nvd.nist.gov/vuln/detail/CVE-2026-48926","https://github.com/jenkinsci/job-import-plugin","https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3783"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-p8jh-4p5p-2rfp","url":"https://osv.dev/vulnerability/GHSA-p8jh-4p5p-2rfp"}],"summary":"Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint"}