{"id":"CVE-2026-117620","title":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature that can be acted on by administrators to inject attacker-controlled data, overriding e…","summary":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature that can be acted on by administrators to inject attacker-controlled data, overriding e…","severity":"none","vendor":"Jenkins Project","product":"Jenkins","affected":["Jenkins (all versions)"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:48:33.708Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117620","references":[{"url":"https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4226","label":"Jenkins Security Advisory 2026-10-28"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.457Z","slug":"CVE-2026-117620","body":"## Overview\n\nJenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.\n\n## Affected\n\n- `Jenkins (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}