CVE-2026-96414
Received
Received - Intake
Privilege Escalation in Octopus Server via Weak Cookie Validation
Vulnerability report for CVE-2026-96414, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Octopus Deploy
Description
Description
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Octopus Deploy | Octopus Server | From 2022.1.3143 (inc) to 2026.2.13487 (exc) |
| Octopus Deploy | Octopus Server | From 2026.3.0 (inc) to 2026.3.15875 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-649 | The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified. |
