Skip to content
OpenAdvisories
High · 8.7 CVE-2026-102488 EUVD-2026-94659GHSA-w6j2-5q9c-xv6x

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obt…

Published Oct 8, 2026 · Updated Oct 8, 2026 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 2019.5.0 – < 2026.2.12438, 2026.3.0 – < 2026.3.15816 2026.2.12438

Advisories 1

References