Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Octopus

Description

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Octopus Deploy Octopus Server

Default version status: unaffected

  • 2023.2.945 to < 2026.1.11768affected
  • 2026.2.0 to < 2026.2.13408affected
  • 2026.3.0 to < 2026.3.15816affected

References