OCTOPUS SERVER · CVE-2026-105948 · Vendor
FIX → 2026.3.15909 +1 ✓ verified
Octopus Server does not properly check permissions when a user edits their own login identities. A user can use this to gain elevated permissions, up to system administrator access.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Octopus Server (Linux and Windows) using LDAP authentication with 'Allow users to edit their own logins' enabled: a user who can edit their own login identities can escalate up to system administrator. Octopus Cloud is already patched; instances without LDAP auth or with that setting off can skip it.
Not affected if non-ldap-auth, octopus-cloud, self-service-login-editing-disabled
Who cares ldap, octopus-deploy, self-hosted
2024.2.5035, all 2024.3.x, 2024.4.x, 2025.x, 2026.1.x, 2026.2.x before 2026.2.13487, 2026.3.x before 2026.3.15909Allow users to edit their own logins is on; if either is off you are not exposedIn affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.3.15909 +1
2026.2.13487 or later (for 2024.x, 2025.x, 2026.1.x, 2026.2.x) or 2026.3.15909 or later (2026.3.x); vendor recommends latest 2026.3.16030t upgrade: turn off Allow users to edit their own logins'