CVE-2026-78210CWE-863broken-access-control

CVE-2026-78210

published October 1, 2026

CVSS
7.1
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-01T09:17Z
References (1)
https://advisories.octopus.com/post/2026/sa2026-13 · [email protected]
EPSS history
Timeline
  • 03 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 01 OCT 04:36Z
    In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the…
    cvelistv5