CVE-2026-117341: High severity Octopus Deploy Octopus Server vulnerability
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
Affected Software
Event History
Frequently Asked Questions
Who can access an exposed invitation code?
The invitation must be linked to a space, and a user in that space must have the appropriate permissions to read the relevant audit event log. The issue does not indicate that unauthenticated users can obtain the code.
What must an attacker do to escalate privileges?
They would need to read the invitation code from the audit event and redeem the invitation before it is claimed. The resulting privilege level depends on the permissions assigned to the invited user.
How can I determine whether an invitation may be exposed?
Review audit event logs for user invitations associated with spaces and identify whether invitation codes were recorded. Also check whether any such invitations remain unclaimed, because redemption of an unclaimed invitation is required for exploitation.