CVE-2026-84653CWE-862broken-access-control

CVE-2026-84653

Low · published September 2, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T20:17Z
Affected products (2)
ProductVersionsFixed in
jenkins/jenkins≥ 2.421, ≤ 2.579—
jenkins/jenkins≥ 2.426.1, ≤ 2.568.2—
References (1)
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 15:40Z
    Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not correctly perform permission checks in the Appearance configuration page, allowing attackers with…
    cvelistv5