{"id":"CVE-2026-84653","details":"Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.","aliases":["BIT-jenkins-2026-84653"],"modified":"2026-09-17T08:04:56.807407Z","published":"2026-09-02T16:17:29.983Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3981"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/jenkins","events":[{"introduced":"3d43353cb685ca0a5eb64be1550abac5791c55c6"},{"last_affected":"9095ea3a5c5e7dcd392695a5dd880af1c9910ddf"},{"introduced":"04ae84057d4e9efefc2e38486674d9eb7bcdd6c5"},{"last_affected":"41a9ef008120dd7d1ada33200ab71be9ca445236"}],"database_specific":{"cpe":["cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*","cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*"],"extracted_events":[{"introduced":"2.421"},{"last_affected":"2.579"},{"introduced":"2.426.1"},{"last_affected":"2.568.2"}],"source":"CPE_RANGE"}}],"versions":["jenkins-2.579","jenkins-2.578","jenkins-2.577","jenkins-2.576","jenkins-2.568.2","jenkins-2.575","jenkins-2.568.2-rc","jenkins-2.574","jenkins-2.573","jenkins-2.568.1","jenkins-2.568.1-rc","jenkins-2.572","jenkins-2.571","jenkins-2.570","jenkins-2.569","jenkins-2.568","jenkins-2.567","jenkins-2.566","jenkins-2.565","jenkins-2.564","jenkins-2.563","jenkins-2.562","jenkins-2.561","jenkins-2.560","jenkins-2.559","jenkins-2.558","jenkins-2.557","jenkins-2.556","jenkins-2.555","jenkins-2.554","jenkins-2.553","jenkins-2.552","jenkins-2.551","jenkins-2.550","jenkins-2.549","jenkins-2.548","jenkins-2.547","jenkins-2.546","jenkins-2.545","jenkins-2.544","jenkins-2.543","jenkins-2.542","jenkins-2.541","jenkins-2.540","jenkins-2.539","jenkins-2.538","jenkins-2.537","jenkins-2.536","jenkins-2.535","jenkins-2.534","jenkins-2.533","jenkins-2.532","jenkins-2.531","jenkins-2.530","jenkins-2.529","jenkins-2.528","jenkins-2.527","jenkins-2.526","jenkins-2.525","jenkins-2.524","jenkins-2.523","jenkins-2.522","jenkins-2.521","jenkins-2.520","jenkins-2.519","jenkins-2.518","jenkins-2.517","jenkins-2.516","jenkins-2.515","jenkins-2.514","jenkins-2.513","jenkins-2.512","jenkins-2.511","jenkins-2.510","jenkins-2.509","jenkins-2.508","jenkins-2.507","jenkins-2.506","jenkins-2.505","jenkins-2.504","jenkins-2.503","jenkins-2.502","jenkins-2.501","jenkins-2.500","jenkins-2.499","jenkins-2.498","jenkins-2.497","jenkins-2.496","jenkins-2.495","jenkins-2.494","jenkins-2.493","jenkins-2.492","jenkins-2.491","jenkins-2.490","jenkins-2.489","jenkins-2.488","jenkins-2.487","jenkins-2.486","jenkins-2.485","jenkins-2.484","jenkins-2.483","jenkins-2.482","jenkins-2.481","jenkins-2.480","jenkins-2.479","jenkins-2.478","jenkins-2.477","jenkins-2.476","jenkins-2.475","jenkins-2.474","jenkins-2.473","jenkins-2.472","jenkins-2.471","jenkins-2.470","jenkins-2.469","jenkins-2.468","jenkins-2.467","jenkins-2.466","jenkins-2.465","jenkins-2.464","jenkins-2.463","jenkins-2.462","jenkins-2.461","jenkins-2.460","jenkins-2.459","jenkins-2.458","jenkins-2.457","jenkins-2.456","jenkins-2.455","jenkins-2.454","jenkins-2.453","jenkins-2.452","jenkins-2.451","jenkins-2.450","jenkins-2.449","jenkins-2.448","jenkins-2.447","jenkins-2.446","jenkins-2.445","jenkins-2.444","jenkins-2.443","jenkins-2.442","jenkins-2.441","jenkins-2.440","jenkins-2.439","jenkins-2.438","jenkins-2.437","jenkins-2.436","jenkins-2.435","jenkins-2.434","jenkins-2.433","jenkins-2.432","jenkins-2.431","jenkins-2.430","jenkins-2.429","jenkins-2.428","jenkins-2.427","jenkins-2.426","jenkins-2.425","jenkins-2.424","jenkins-2.423","jenkins-2.422","jenkins-2.421"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84653.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N"}]}