Octopus Server CVE-2026-117341

Exploitation requires an authenticated Octopus Server user who has permission to read audit events within a space (PR:L), AND the pre-existence of an unclaimed user invitation that was linked to that same space - the invitation code is only exposed in the audit event when the invitation is space-linked. The attack requirement (AT:P) is precisely this dependency on an existing unclaimed, space-linked invitation, which the attacker does not control. The severity of the resulting privilege escalation is bounded by the permissions assigned to the invited (not-yet-claimed) account: if that account has only equal or lower privileges, no meaningful escalation occurs. Limiting factors: prior authentication and audit-read permission, presence of an unredeemed space-linked invitation, and the invited user's permission level. Affected: Octopus Server 2019.0.0 up to (not including) 2026.2.13438, and 2026.3.0 up to (not including) 2026.3.15829; updating to those fixed versions is the vendor remedy.

This is a moderate-priority, authenticated privilege-escalation flaw (CWE-532, sensitive invitation code written to the audit event log) rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, VC/VI/VA:H, score 7.7) shows the key limiting signals clearly: PR:L means an already-authenticated Octopus user is required, and AT:P indicates a specific precondition must exist (an unclaimed invitation that was linked to the space the attacker can see) - this is not attacker-controlled on demand. There is no KEV listing and no EPSS score supplied, and the only references are the vendor advisory and the NVD entry, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' and the vendor (Octopus) self-reported with a patch already available, which together argue for prompt patching but not emergency response. The high VC/VI/VA impact reflects that successful escalation could yield broad access, but the real-world impact is explicitly conditional: the advisory states escalation depends on the permissions assigned to the invited user, so a low-privilege invitation yields little gain. Net: a real issue to remediate on a normal patch cycle, not a high-CVSS-but-trivially-exploited internet-facing bug.

An authenticated Octopus Server user who has permission to view audit events in a given space reads the audit log, finds the invitation code for an unclaimed user invitation that was linked to that space, and redeems it. If the invited account was provisioned with higher permissions than the attacker, the attacker gains those elevated privileges. No public exploit code is identified; the attack is network-reachable (web app) but requires an existing unclaimed invitation and audit-read access.