CVE-2026-4881 — Octopus Deploy / Octopus Server

CVE-2026-4881

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.

Affected (CNA)

Vendor / product	Versions
Octopus Deploy / Octopus Server	affected 2023.0.0 before 2025.4.10523; affected 2025.4.0 before 2025.4.10545; affected 2026.1.0 before 2026.1.11313

CWE

No CWE identifiers supplied.

References

https://advisories.octopus.com/post/2026/sa2026-04

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.