CVE-2017-17665

High

Published: 13/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Octopus Deploy before version 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.

Risk Assessment

The organization may be exposed to unauthorized access to sensitive environments, potentially leading to unauthorized changes or data leaks.

Recommendation

It is recommended to upgrade Octopus Deploy to version 4.1.3 or later to ensure proper access checks for users to environments.

Other vulnerabilities in Octopus Deploy

CVE-2026-12702Medium
In affected versions of Octopus Deploy, insufficient checks on project trigger actions allow an unauthorized user to trigger a deployment.

Original NVD description (English source)

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS