Description
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 3.5 – < unspecified, unspecified – < 2022.1.3264, 2022.2.6729 – < unspecified, unspecified – < 2022.2.8277, 2022.3.348 – < unspecified, unspecified – < 2022.3.10586, 2022.4.791 – < unspecified, unspecified – < 2022.4.2898 | unspecified |