Description (CNA)
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Octopus Deploy / Octopus Server | affected 2023.2.945 before 2026.1.11768; affected 2026.2.0 before 2026.2.13408; affected 2026.3.0 before 2026.3.15816 |
CWE
CWE-1289
References
ADP enrichment
No English description supplied.
No references supplied.