jenkins: Jenkins: Unauthorized configuration modification due to incorrect permission checks
Published Sep 2, 2026
3.5
LOWCVSS 3.1
EPSS 0.34%
Description
Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
Affected products
Remediation
Red Hat statement
A flaw was found in Jenkins. Unauthorized configuration modification is possible due to incorrect permission checks in REST and CLI endpoints. Users with Overall/Manage permission can modify certain configuration settings without proper authorization. When combined with the Simple Theme Plugin, this can lead to cross-site scripting vulnerabilities. This issue affects Jenkins versions up to 2.579 (weekly) and up to 2.568.2 (LTS).
Red Hat mitigation
Update to Jenkins 2.580 (weekly) or Jenkins LTS 2.568.3 or later.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-84653 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2527590 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70119 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84653
- https://www.cve.org/CVERecord?id=CVE-2026-84653
- https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981 vendor-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-84653 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2527590 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70119 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-84653 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-84653 | ||
| https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981 | vendor-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.