CVE-2026-105948
Received
Received - Intake
Incorrect Permission Validation in Octopus Server Leading to Privilege Escalation
Vulnerability report for CVE-2026-105948, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Octopus Deploy
Description
Description
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Octopus Deploy | Octopus Server | From 2024.2.5035 (inc) to 2026.2.13487 (exc) |
| Octopus Deploy | Octopus Server | From 2026.3.0 (inc) to 2026.3.15909 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
