Permission Escalation in Octopus Server by Octopus Deploy
CVE-2026-105948

7.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
11 November 2026

What is CVE-2026-105948?

In certain versions of Octopus Server, a flaw exists due to inadequate validation of user permissions. This vulnerability allows users who have the ability to edit their own login identities to mistakenly gain elevated permissions, possibly reaching system administrator levels. This issue prominently affects instances utilizing LDAP authentication where self-service login editing is enabled, emphasizing the need for robust permission checks to prevent unauthorized access.

Affected Version(s)

Octopus Server Windows 2024.2.5035 < 2026.2.13487

Octopus Server Windows 2026.3.0 < 2026.3.15909

References

https://advisories.octopus.com/post/2026/sa2026-21

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.