medium6.5
CVE-2026-4881
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes usin…
Impact
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Server | from 2023.1.4189 before 2025.4.10545 from 2026.1.675 before 2026.1.11313 |