CVE-2026-102478 | BDVDB-2026-384249 Detail

Description#

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-07Record published in the CVE List.