CVE-2026-124627: High severity vulnerability
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.
Event History
Frequently Asked Questions
Which deployments are affected?
Only Octopus Server instances that have LDAP authentication enabled and LDAP groups mapped to Octopus teams are affected. Instances without that combination are not described as affected.
What access does an attacker need to exploit this issue?
The issue concerns a newly registered user whose external identity is incorrectly validated. The supplied severity vector indicates low privileges are required and no user interaction is required.
What could an affected user gain?
A newly registered user could receive LDAP-mapped team memberships and the associated permissions belonging to another user. The impact can include high confidentiality, integrity, and availability consequences according to the supplied severity vector.