CVE-2022-36888: Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests

The vulnerability stemmed from missing Jenkins.ADMINISTER permission checks in 'doTestConnection' methods across multiple credential implementations. These methods handle HTTP endpoints for Vault connection testing. The commit 3b38d76 explicitly adds Jenkins.get().checkPermission(Jenkins.ADMINISTER) to all these methods, confirming they were the attack surface. The CWE-862 (Missing Authorization) maps directly to the absence of these checks, allowing attackers with lower privileges to exploit the endpoints. The Jelly UI changes further support this by hiding test buttons from non-admins, but the core vulnerability was in the backend authorization logic.