CVE-2026-4881

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes…

Medium · published June 4, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00368 · 29.5th percentile
Published
2026-06-04T08:49Z
EPSS history
Timeline
  • 04 JUN 08:49Z
    In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes…
    cvelistv5