CVE-2026-124628: High severity vulnerability
In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with an LDAP identity in an affected Octopus Server installation can exploit it by modifying their own identity. The issue applies even when an Administrator has disabled self-service identity editing.
What conditions are required for privilege escalation?
The installation must use teams mapped to external LDAP groups. Escalation occurs if the user can alter their identity to gain membership in one of those mapped groups, with full administrative privileges possible when a mapped team is privileged.
How can administrators determine whether the impact could be severe?
Review teams mapped to external LDAP groups and identify whether any of those teams have privileged or administrative permissions. If such mappings exist, affected users may be able to obtain those permissions by editing their LDAP identity.