Data Exposure Vulnerability in Octopus Deploy with Active Directory Authentication

CVE-2025-0589

What is CVE-2025-0589?

In specific versions of Octopus Deploy utilizing Active Directory for user authentication, an unauthenticated attacker can exploit two API endpoints. This enables the retrieval of sensitive information from user profiles, including the user's email address and display name, as well as group details like Group ID and Display Name. Importantly, this vulnerability does not compromise any data stored within the Octopus Server product itself.

References