[JENKINS-50032] Jobs can be triggered with only Job/Read and Job/Configure

• Create a job and assign an Authentication Token under Trigger builds remotely (e.g., from scripts)


• Create a user and only assign Job/Read and Job/Configure permission for this job.


• Navigate to the job as the newly created user, retrieve the build URL which contains the token.


• The user cannot build this job via the UI.


• Retrive the user's API token ($JENKINS_URL/users/$USERNAME)


• Go to command line and use the following curl command: curl -X POST $JENKINS_URL/job/$JOB_NAME/build?token\=$AUTHENTICATION_TOKEN -u $USER_NAME:$API_TOKEN


• The job will be now be built.

---
Originally reported by joshshinn, imported from: Jobs can be triggered with only Job/Read and Job/Configure

• status: Open
  
• priority: Major
  
• component(s): parameterized-trigger-plugin
  
• label(s): security
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

	
Create a job and assign an Authentication Token under Trigger builds remotely (e.g., from scripts)

	
Create a user and only assign Job/Read and Job/Configure permission for this job.

	
Navigate to the job as the newly created user, retrieve the build URL which contains the token.

	
The user cannot build this job via the UI.

	
Retrive the user's API token ($JENKINS_URL/users/$USERNAME)

	
Go to command line and use the following curl command: curl -X POST $JENKINS_URL/job/$JOB_NAME/build?token\=$AUTHENTICATION_TOKEN -u $USER_NAME:$API_TOKEN

	
The job will be now be built.

• environment: Parameterized trigger plugin 2.35.2