{"id":"CVE-2026-84653","title":"Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify App…","summary":"Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify App…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-862","CWE-266"],"vendor":"jenkins","product":"jenkins","affected":["jenkins >= 2.421, <= 2.579","jenkins >= 2.426.1, <= 2.568.2"],"published":"2026-09-02","updated":"2026-09-15","sourceUpdated":"2026-09-15T18:15:37.527","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84653","references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981","label":"jenkinsci-cert@googlegroups.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84653.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84653"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527590"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84653"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84653"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00338,"epssPercentile":0.27089,"ingestedAt":"2026-09-15T18:41:59.124Z","scores":{"nvd":3.5,"vendor":2.7},"slug":"CVE-2026-84653","body":"## Overview\n\nJenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.\n\n## Affected\n\n- `jenkins >= 2.421, <= 2.579`\n- `jenkins >= 2.426.1, <= 2.568.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: OpenShift Developer Tools and Services · no fix planned: OpenShift Developer Tools and Services · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84653.json)","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}