CVE-2026-102488 — Octopus Deploy / Octopus Server

CVE-2026-102488

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.

Affected (CNA)

Vendor / product	Versions
Octopus Deploy / Octopus Server	affected 2019.5.0 before 2026.2.12438; affected 2026.3.0 before 2026.3.15816

CWE

CWE-863

References

https://advisories.octopus.com/post/2026/sa2026-12

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.