CVE-2026-12878

Analyzed Analyzed - Analysis Complete

Authenticated Privilege Escalation in Codefresh Platform

Publication date: 2026-08-25

Last updated on: 2026-09-02

Assigner: Octopus Deploy

Description

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-02

Generated

2026-09-15

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-14

NVD

CVE-2026-12878

EUVD

EUVD-2026-65354

Affected Vendors & Products

Vendor	Product	Version / Range
octopus	codefresh	From 2.0.0 (inc) to 2.11.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user in the Codefresh platform to exploit an API endpoint and elevate their permissions to admin level. It affects Codefresh versions prior to 2.11.15.

Detection Guidance

Check Codefresh version with: curl -s https://<codefresh-domain>/api/version | grep version. If version is below 2.11.15, the system is vulnerable.

Impact Analysis

An attacker with valid credentials could gain admin access, potentially allowing them to modify configurations, access sensitive data, or disrupt operations within the Codefresh platform.

Compliance Impact

This vulnerability allows authenticated users to escalate privileges to admin level, which could lead to unauthorized access to sensitive data. For GDPR, this may result in violations of data protection principles due to unauthorized access. For HIPAA, it could compromise protected health information integrity and confidentiality. Organizations using affected Codefresh versions may face compliance failures and potential regulatory penalties.

Mitigation Strategies

Upgrade Codefresh to version 2.11.15 or higher immediately. No workarounds exist, so patching is critical to prevent privilege escalation.

Hi! I’m here to help you understand CVE-2026-12878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70