{"schema_version":"1","data":[{"id":12445,"advisory_id":"9d63fa47-6456-47ff-b415-ca659d67b19a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102488","source_published_at":"2026-10-08T01:38:57.175+00:00","published_at":"2026-10-25T00:07:55.392414+00:00","extraction_method":"structured","technologies":["core-cve","octopus-server"],"cve_ids":["CVE-2026-102488"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-102488","summary":"In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.","evidence":"cve:CVE-2026-102488","products":[{"name":{"value":"Octopus Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102488","aliases":["CVE-2026-102488"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"status":"affected","version":"2019.5.0","lessThan":"2026.2.12438","versionType":"custom"},{"status":"affected","version":"2026.3.0","lessThan":"2026.3.15816","versionType":"custom"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-08T11:18:23.548Z","provider":"cve","references":["https://advisories.octopus.com/post/2026/sa2026-12"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102488","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T11:14:07.011181Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T11:18:23.548Z"}}],"cna":{"orgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","shortName":"Octopus","dateUpdated":"2026-10-08T01:38:57.175Z"}}},"related_cves":[{"value":"CVE-2026-102488","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12149,"advisory_id":"7ca8b897-c199-4e19-bc10-2265618907bf","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102478","source_published_at":"2026-10-07T01:17:54.724+00:00","published_at":"2026-10-25T00:02:44.357469+00:00","extraction_method":"structured","technologies":["core-cve","octopus-server"],"cve_ids":["CVE-2026-102478"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-102478","summary":"In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.","evidence":"cve:CVE-2026-102478","products":[{"name":{"value":"Octopus Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102478","aliases":["CVE-2026-102478"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"status":"affected","version":"2023.2.945","lessThan":"2026.1.11768","versionType":"custom"},{"status":"affected","version":"2026.2.0","lessThan":"2026.2.13408","versionType":"custom"},{"status":"affected","version":"2026.3.0","lessThan":"2026.3.15816","versionType":"custom"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-07T18:40:25.736Z","provider":"cve","references":["https://advisories.octopus.com/post/2026/sa2026-11"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102478","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T18:40:08.538496Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-07T18:40:25.736Z"}}],"cna":{"orgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","shortName":"Octopus","dateUpdated":"2026-10-07T01:17:54.724Z"}}},"related_cves":[{"value":"CVE-2026-102478","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":5666,"advisory_id":"8bd44fc9-1e91-439d-955f-86166a7317b9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78210","source_published_at":"2026-10-01T04:36:23.243+00:00","published_at":"2026-10-24T22:12:38.560234+00:00","extraction_method":"structured","technologies":["core-cve","octopus-server"],"cve_ids":["CVE-2026-78210"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-78210","summary":"In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.","evidence":"cve:CVE-2026-78210","products":[{"name":{"value":"Octopus Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-78210","aliases":["CVE-2026-78210"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"status":"affected","version":"2019.5.9","lessThan":"2026.1.11739","versionType":"custom"},{"status":"affected","version":"2026.2.0","lessThan":"2026.2.13364","versionType":"custom"},{"status":"affected","version":"2026.3.0","lessThan":"2026.3.13951","versionType":"custom"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-01T15:55:46.579Z","provider":"cve","references":["https://advisories.octopus.com/post/2026/sa2026-13"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-78210","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T15:54:59.744498Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T15:55:46.579Z"}}],"cna":{"orgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","shortName":"Octopus","dateUpdated":"2026-10-01T04:36:23.243Z"}}},"related_cves":[{"value":"CVE-2026-78210","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":3830,"advisory_id":"96681529-d62d-4e3e-be31-291b6db42b2b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101169","source_published_at":"2026-09-29T07:49:29.618+00:00","published_at":"2026-10-24T21:41:11.272918+00:00","extraction_method":"structured","technologies":["core-cve","octopus-server"],"cve_ids":["CVE-2026-101169"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-101169","summary":"In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.","evidence":"cve:CVE-2026-101169","products":[{"name":{"value":"Octopus Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-101169","aliases":["CVE-2026-101169"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Octopus Deploy","product":"Octopus Server","versions":[{"status":"affected","version":"2019.4.1","lessThan":"2026.1.11781","versionType":"custom"},{"status":"affected","version":"2026.2.0","lessThan":"2026.2.13441","versionType":"custom"},{"status":"affected","version":"2026.3.0","lessThan":"2026.3.15829","versionType":"custom"}],"platforms":["Windows","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-09-29T16:46:34.454Z","provider":"cve","references":["https://advisories.octopus.com/post/2026/sa2026-10"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101169","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T16:46:21.130403Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T16:46:34.454Z"}}],"cna":{"orgId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","shortName":"Octopus","dateUpdated":"2026-09-29T07:49:29.618Z"}}},"related_cves":[{"value":"CVE-2026-101169","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false}],"next_after":12445,"next_before":3830}