Octopus Server CVE-2026-78210

Exploitation requires an authenticated Octopus Server account that already holds a specific scoped permission set (PR:L); it is not reachable by anonymous users. Given that foothold, the attacker can execute arbitrary scripts against an environment outside the authorization granted to their scoped permissions, with no user interaction (UI:N) and low attack complexity (AC:L). The limiting factors are the need for valid credentials with some scoped permission and access to the Octopus management interface; there is no indication a non-default configuration is required, but the exact vulnerable/fixed versions are not stated in the available data and should be confirmed against vendor advisory sa2026-13.

This is an authenticated privilege/authorization issue (CWE-863) in Octopus Server, not a true authentication bypass despite the tag. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable flaw of low attack complexity requiring low-level privileges - i.e. the attacker must already be a legitimate Octopus user holding some scoped permission set, which substantially narrows the attacker population to insiders or compromised accounts rather than anonymous internet attackers. Impact is integrity-dominant (VI:H) with limited availability impact (VA:L) and no confidentiality impact (VC:N) per the vendor, consistent with executing arbitrary deployment scripts in an environment the user was not authorized to target. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no public-exploitation signal; the 7.1 score is driven by the ease of abuse once authenticated and the high integrity impact of arbitrary script execution, not by evidence of real-world attacks. Net: a genuine authorization-boundary defect worth prompt patching for organizations running Octopus with many scoped users, but real-world urgency is moderated by the required authenticated foothold and the absence of any exploitation or POC evidence. No CVSS 3.1 vector was supplied by the source - only the vendor's 4.0 vector - so cross-version comparison relies on an inferred 3.1 mapping.

A legitimate Octopus Server user who holds a narrowly-scoped permission set (for example, deployment rights limited to one environment or project) crafts or triggers a script execution against an environment they were never granted authority over, because the server fails to enforce the authorization boundary for that scoped set. The arbitrary script then runs in the unauthorized environment with the automation server's deployment context, enabling tampering with deployments or targets. No public exploit code is identified at time of analysis.