3.5

CVE-2026-84653

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Jenkins SwEdition - Version >= 2.421 <= 2.579
Jenkins ≫ Jenkins SwEdition lts Version >= 2.426.1 <= 2.568.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.059
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 3.5 0.9 2.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981
Vendor Advisory