EUVD-2026-94154
GHSA-r946-p43h-mw8h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because a valid account with role-modify permission is required; AV:N/AC:L for a reliable network-reachable logic bypass; S:U as impact stays within the Octopus authorization domain; C/I/A:H from full administrative takeover.
Primary rating from Vendor (Octopus).
CVSS VectorVendor: Octopus
Lifecycle Timeline
3DescriptionCVE.org
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
AnalysisAI
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a built-in role's protections and add their own account to a privileged team, effectively granting themselves administrative reach without ever being assigned those rights legitimately. The flaw stems from improper validation of unsafe equivalence in input (CWE-1289), meaning role/permission data that should not be treated as equivalent is mishandled during validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Octopus Server account that already holds the permission to modify roles; this is the exact gating prerequisite and the primary limiter on real-world risk. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, moderately-high-priority privilege-escalation flaw whose risk is tempered by its access prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed build specified in Octopus advisory SA2026-11 (https://advisories.octopus.com/post/2026/sa2026-11); because the available data does not state an exact patched version number, the advisory's fixed-build list must be used to confirm the target version rather than assuming one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, treat SA2026-11 as the authoritative advisory, inventory all Octopus Server instances and identify every account holding role-modification or team-management permissions; immediately reduce that set to the smallest trusted administrator group and remove delegated role-editing rights from general users, and pull and review audit logs for unexpected role edits or team membership changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Octopus Server
View allIn Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server f
Authenticated remote code execution in Octopus Server allows any user whose role grants permission to edit an Environmen
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorre
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today