PT-2026-84795 · Jenkins · Jenkins Microsoft Entra Id (Previously Azure Ad) Plugin

CVE-2026-84672

·

Published

2026-09-02

·

Updated

2026-09-02

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

Fix

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-84672

Affected Products

Jenkins Microsoft Entra Id (Previously Azure Ad) Plugin