Description
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2026.3.0 <2026.3.15909 | — |
| Octopus Deploy | Octopus Server | 2024.2.5035 <2026.2.13487 | — |
Advisories 1
- WID-SEC-2026-4477 Octopus Deploy: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Nov 10, 2026