CVE-2026-93487
Received
Received - Intake
Incorrect Permission Validation in Octopus Server Allows Unauthorized Runbook Execution
Vulnerability report for CVE-2026-93487, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Octopus Deploy
Description
Description
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Octopus Deploy | Octopus Server | From 2019.11.0 (inc) to 2026.2.13487 (exc) |
| Octopus Deploy | Octopus Server | From 2026.3.0 (inc) to 2026.3.15863 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
