Skip to main content

Octopus Server CVE-2026-12702

| EUVDEUVD-2026-48531 MEDIUM
Improper Access Control (CWE-284)
2026-07-24 Octopus GHSA-xqwp-7cxx-5588
Authentication Bypass Octopus Server Octopus Deploy
5.1
CVSS 4.0 · Vendor: Octopus
Share

Severity by source

Vendor (Octopus) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Octopus) · only source for this CVE.

CVSS VectorVendor: Octopus

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 12:21 vuln.today
Patch available
Jul 24, 2026 - 10:02 EUVD

DescriptionCVE.org

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.

AnalysisAI

Improper access control in Octopus Deploy allows an authenticated attacker with high privileges to trigger deployments without proper authorization. Affected versions include Octopus Server 2023.0.0 through 2026.1.x before 2026.1.11587 and 2026.2.0 before 2026.2.13190. No active exploitation or public exploit code is known; EPSS indicates low exploitation probability.

More in Octopus Server

View all
CVE-2018-18850 HIGH POC
8.8 Oct 31

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment

CVE-2019-11632 HIGH POC
8.1 May 01

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
CVE-2026-4881 MEDIUM POC
6.0 Jun 04

Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci
CVE-2022-2572 CRITICAL
9.8 Nov 01

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
CVE-2022-2778 CRITICAL
9.8 Sep 30

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical

CVE-2018-11320 CRITICAL
9.8 May 21

In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
CVE-2026-0704 CRITICAL
9.1 Feb 25

Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
CVE-2022-2782 CRITICAL
9.1 Oct 27

In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
CVE-2026-92355 HIGH
8.7 Sep 16

Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server f
CVE-2024-9194 HIGH
8.7 Sep 30

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
CVE-2022-2780 HIGH
8.1 Oct 14

In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to in
CVE-2021-26556 HIGH
7.8 Oct 07

When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-12702 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy