CVE-2026-124627

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.

CWE	CWE-863
Vendor	octopus deploy
Product	octopus server
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for octopus deploy octopus server

Be the first to know when new unknown vulnerabilities affecting octopus deploy octopus server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Octopus Deploy / Octopus Server

3.0.0 < 2026.2.13526 2026.3.0 < 2026.3.15926

References

NVD ↗ CVE.org ↗ EPSS Data ↗

advisories.octopus.com: https://advisories.octopus.com/post/2026/sa2026-23

Credits

This vulnerability was found by Nathan Willoughby