PT-2026-84795 · Jenkins · Jenkins Microsoft Entra Id (Previously Azure Ad) Plugin
CVE-2026-84672
·
Published
2026-09-02
·
Updated
2026-09-02
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins Microsoft Entra Id (Previously Azure Ad) Plugin