CVE-2026-4881
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
Risk Assessment
Lack of proper permission checks could allow unauthorized users to modify server configuration, potentially leading to security breaches or service disruption.
Recommendation
Update Octopus Server to the latest patched version. Review API access logs for suspicious activity.
Other vulnerabilities in Octopus Server
See all- CVE-2026-14163High
In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.
- CVE-2026-8296Medium
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
Original NVD description (English source)
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.