CVE-2026-105948

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.

CWE	CWE-863
Vendor	octopus deploy
Product	octopus server
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for octopus deploy octopus server

Be the first to know when new unknown vulnerabilities affecting octopus deploy octopus server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Octopus Deploy / Octopus Server

2024.2.5035 < 2026.2.13487 2026.3.0 < 2026.3.15909

References

NVD ↗ CVE.org ↗ EPSS Data ↗

advisories.octopus.com: https://advisories.octopus.com/post/2026/sa2026-21

Credits

This vulnerability was found by Nathan Willoughby