CVE-2026-4881
MEDIUM WAF: Low
CVSS 6.5
Published: 2026-06-04
CWE-862
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
WAF Coverage Analysis
Missing Authorization
Low WAF Coverage
OWASP: A01:2021 Broken Access Control
Affected Software
| Vendor | Product | Version |
|---|---|---|
| octopus | octopus_server | 2023.1.4189 - 2025.4.10545 |
| octopus | octopus_server | 2026.1.675 - 2026.1.11313 |
References
- advisories.octopus.com (Vendor Advisory)