Jenkins prior to 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
jenkins jenkins