MinorCritical vulnerability
CVE-2026-105948 (CVSS 7.7)
NVD · officialPublished Nov 11, 2026Risk 23/100
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.
Technical details
CVSS
7.7
AV:NetworkAC:LowPR:LowUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source