CVE-2026-12878CWE-269privilege-escalation

CVE-2026-12878

High · published August 25, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-08-25T14:18Z
Affected products (1)
ProductVersionsFixed in
octopus/codefresh≥ 2.0.0, < 2.11.152.11.15
References (1)
https://advisories.codefresh.io/post/2026/sa2026-01/ · [email protected]
EPSS history
Timeline
  • 27 AUG 06:17Z
    EPSS moved — → 0%
    epss
  • 25 AUG 09:02Z
    In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions
    cvelistv5