Octopus Server: Privilege escalation via LDAP login editing
Summary
Octopus Server contains an incorrect authorization flaw (CWE-863) in the validation of permissions for editing a user's own login identities. If LDAP authentication and self-service login editing are enabled, an authenticated user can edit their own login identities and gain elevated permissions, up to system administrator access. The attacker needs a valid account on the instance, and the vendor rates the severity as high.
Affected
- Octopus Server 2024.2.x after 2024.2.5035
- Octopus Server 2024.3.x, 2024.4.x, 2025.x and 2026.1.x (all versions)
- Octopus Server 2026.2.x before 2026.2.13487
- Octopus Server 2026.3.x before 2026.3.15909
- Only instances with LDAP authentication and self-service login editing enabled are affected. Octopus Cloud instances have already been updated.
Fixed in
- Octopus Server 2026.2.13487 (for the 2026.2 line)
- Octopus Server 2026.3.15909 (for the 2026.3 line)
- Vendor's latest version at time of advisory: 2026.3.16030
Workaround
- Disable the option 'Allow users to edit their own logins' until the upgrade is complete.
- Review team membership and the audit log for LDAP identities that were recently added to user accounts.
Exploitation
- The vendor is not aware of any public announcements or malicious use of this vulnerability.
- Not listed in CISA KEV.
- No public exploit code found at the time of research.
Our recommendation
- Check whether LDAP authentication and self-service login editing are enabled on the Octopus Server.
- Upgrade to 2026.2.13487 or 2026.3.15909 (or later), depending on the release line in use.
- If an immediate upgrade is not possible, disable self-service login editing.
- Review team membership, role changes and the audit log for unexpected LDAP identities or elevated permissions.
- Prioritise this if the server is reachable from outside the company network.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Deploy Security Advisory 2026-21 advisories.octopus.com
- CVE-2026-105948 record (OpenCVE) app.opencve.io
- CVE-2026-105948 tracker (OffSeq Radar) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:22.
Original description (NVD)
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.