Low
Security advisory
Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-84653
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:21 UTC · Revision 1
Source evidence
Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
osv:CVE-2026-84653
Complete source record
{
"id": "04548f0d444d315ffbe94b4efbd1a92f5e171133be3f6141a47e17610ac4bdc9",
"url": "https://osv.dev/vulnerability/CVE-2026-84653",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-84653",
"summary": "Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.",
"evidence": "osv:CVE-2026-84653",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-84653",
"aliases": [
"BIT-jenkins-2026-84653",
"CVE-2026-84653"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jenkinsci/jenkins",
"type": "GIT",
"events": [
{
"introduced": "3d43353cb685ca0a5eb64be1550abac5791c55c6"
},
{
"last_affected": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf"
},
{
"introduced": "04ae84057d4e9efefc2e38486674d9eb7bcdd6c5"
},
{
"last_affected": "41a9ef008120dd7d1ada33200ab71be9ca445236"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "2.421"
},
{
"last_affected": "2.579"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "2.426.1"
},
{
"last_affected": "2.568.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"jenkins-2.579",
"jenkins-2.578",
"jenkins-2.577",
"jenkins-2.576",
"jenkins-2.568.2",
"jenkins-2.575",
"jenkins-2.568.2-rc",
"jenkins-2.574",
"jenkins-2.573",
"jenkins-2.568.1",
"jenkins-2.568.1-rc",
"jenkins-2.572",
"jenkins-2.571",
"jenkins-2.570",
"jenkins-2.569",
"jenkins-2.568",
"jenkins-2.567",
"jenkins-2.566",
"jenkins-2.565",
"jenkins-2.564",
"jenkins-2.563",
"jenkins-2.562",
"jenkins-2.561",
"jenkins-2.560",
"jenkins-2.559",
"jenkins-2.558",
"jenkins-2.557",
"jenkins-2.556",
"jenkins-2.555",
"jenkins-2.554",
"jenkins-2.553",
"jenkins-2.552",
"jenkins-2.551",
"jenkins-2.550",
"jenkins-2.549",
"jenkins-2.548",
"jenkins-2.547",
"jenkins-2.546",
"jenkins-2.545",
"jenkins-2.544",
"jenkins-2.543",
"jenkins-2.542",
"jenkins-2.541",
"jenkins-2.540",
"jenkins-2.539",
"jenkins-2.538",
"jenkins-2.537",
"jenkins-2.536",
"jenkins-2.535",
"jenkins-2.534",
"jenkins-2.533",
"jenkins-2.532",
"jenkins-2.531",
"jenkins-2.530",
"jenkins-2.529",
"jenkins-2.528",
"jenkins-2.527",
"jenkins-2.526",
"jenkins-2.525",
"jenkins-2.524",
"jenkins-2.523",
"jenkins-2.522",
"jenkins-2.521",
"jenkins-2.520",
"jenkins-2.519",
"jenkins-2.518",
"jenkins-2.517",
"jenkins-2.516",
"jenkins-2.515",
"jenkins-2.514",
"jenkins-2.513",
"jenkins-2.512",
"jenkins-2.511",
"jenkins-2.510",
"jenkins-2.509",
"jenkins-2.508",
"jenkins-2.507",
"jenkins-2.506",
"jenkins-2.505",
"jenkins-2.504",
"jenkins-2.503",
"jenkins-2.502",
"jenkins-2.501",
"jenkins-2.500",
"jenkins-2.499",
"jenkins-2.498",
"jenkins-2.497",
"jenkins-2.496",
"jenkins-2.495",
"jenkins-2.494",
"jenkins-2.493",
"jenkins-2.492",
"jenkins-2.491",
"jenkins-2.490",
"jenkins-2.489",
"jenkins-2.488",
"jenkins-2.487",
"jenkins-2.486",
"jenkins-2.485",
"jenkins-2.484",
"jenkins-2.483",
"jenkins-2.482",
"jenkins-2.481",
"jenkins-2.480",
"jenkins-2.479",
"jenkins-2.478",
"jenkins-2.477",
"jenkins-2.476",
"jenkins-2.475",
"jenkins-2.474",
"jenkins-2.473",
"jenkins-2.472",
"jenkins-2.471",
"jenkins-2.470",
"jenkins-2.469",
"jenkins-2.468",
"jenkins-2.467",
"jenkins-2.466",
"jenkins-2.465",
"jenkins-2.464",
"jenkins-2.463",
"jenkins-2.462",
"jenkins-2.461",
"jenkins-2.460",
"jenkins-2.459",
"jenkins-2.458",
"jenkins-2.457",
"jenkins-2.456",
"jenkins-2.455",
"jenkins-2.454",
"jenkins-2.453",
"jenkins-2.452",
"jenkins-2.451",
"jenkins-2.450",
"jenkins-2.449",
"jenkins-2.448",
"jenkins-2.447",
"jenkins-2.446",
"jenkins-2.445",
"jenkins-2.444",
"jenkins-2.443",
"jenkins-2.442",
"jenkins-2.441",
"jenkins-2.440",
"jenkins-2.439",
"jenkins-2.438",
"jenkins-2.437",
"jenkins-2.436",
"jenkins-2.435",
"jenkins-2.434",
"jenkins-2.433",
"jenkins-2.432",
"jenkins-2.431",
"jenkins-2.430",
"jenkins-2.429",
"jenkins-2.428",
"jenkins-2.427",
"jenkins-2.426",
"jenkins-2.425",
"jenkins-2.424",
"jenkins-2.423",
"jenkins-2.422",
"jenkins-2.421"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84653.json"
}
}
],
"modified": "2026-10-24T10:30:17.569036683Z",
"provider": "osv",
"references": [
"https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-84653",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429591,
"published_at": "2026-09-02T16:17:29.983+00:00"
}