Description
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2026.3.0 <2026.3.15926 | — |
| Octopus Deploy | Octopus Server | 3.0.0 <2026.2.13526 | — |
Advisories 1
- WID-SEC-2026-4541 Octopus Deploy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026