Dashboard / CVE-2026-124628

CVE-2026-124628

HIGH
MEDIUM Priority: 0.02 BB Relevance: 67/100
Published: 2026-11-12 Modified: 2026-11-12 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Octopus Deploy Octopus Server 2018.3.0 < 2026.2.13526
Octopus Deploy Octopus Server 2026.3.0 < 2026.3.15936

References & Advisories (1)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.21%
Raw Score 0.002070
Percentile 10.9%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links