MajorCritical vulnerability
CVE-2026-102488 (CVSS 8.7)
NVD · officialPublished Oct 8, 2026Risk 37/100
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
Technical details
CVSS
8.7
AV:NetworkAC:LowPR:LowUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source