{"id":"CVE-2026-105948","kind":"vulnerability","aliases":["CVE-2026-105948"],"related":[],"title":"Octopus Server: users can grant themselves admin rights via login edits","description":"In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.","summary":"Octopus Server does not properly check permissions when a user edits their own login identities. A user can use this to gain elevated permissions, up to system administrator access.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13487","2026.3.15909"],"affected":"> 2024.2.5035, < 2026.2.13487; >= 2026.3.0, < 2026.3.15909","ecosystem":"vendor"}],"ecosystems":[],"tags":["ldap","octopus-deploy","self-hosted","vendor"],"not_affected_if":["non-ldap-auth","octopus-cloud","self-service-login-editing-disabled"],"how_to_check":"Check Octopus Server version: affected are 2024.2.x after 2024.2.5035, all 2024.3.x, 2024.4.x, 2025.x, 2026.1.x, 2026.2.x before 2026.2.13487, 2026.3.x before 2026.3.15909. Then check whether the LDAP auth provider is enabled and 'Allow users to edit their own logins' is on; if either is off you are not exposed. Review team membership and the audit log for LDAP identities recently added to user accounts.","fix":"Upgrade Octopus Server to 2026.2.13487 or later (for 2024.x, 2025.x, 2026.1.x, 2026.2.x) or 2026.3.15909 or later (2026.3.x); vendor recommends latest 2026.3.16030. Workaround if you can't upgrade: turn off 'Allow users to edit their own logins'. Octopus Cloud already patched.","status":"open","published_at":"2026-11-11T08:17:16+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:46+00:00","updated_at":"2026-11-11T08:29:01+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T08:27:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: users can grant themselves admin rights via login edits","impact":"high","summary":"Octopus Server does not properly check permissions when a user edits their own login identities. A user can use this to gain elevated permissions, up to system administrator access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["octopus-deploy","ldap","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user gains system administrator access on the Octopus Server","analyst_note":"Find the affected version ranges and fixed versions in the NVD entry or Octopus's security advisory.","how_to_check":"- Check whether Octopus Server uses LDAP authentication with self-service login editing enabled.\n- Check the Octopus Server version against the affected ranges in the NVD entry (unknown from the sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-ldap-auth","self-service-login-editing-disabled"],"who_is_affected":"Only instances using LDAP authentication with self-service login editing enabled are described as affected. Instances using other login methods, or with self-service login editing turned off, are not described as affected. The sources do not list the affected version ranges.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4543,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version ranges and fixed versions in the NVD entry or Octopus's security advisory.","search":"'-105948':14A,17A '-2026':13A,16A 'access':56B,96C 'admin':7A 'administr':55B,95C 'affect':58C,99C 'allow':73C 'assign':67C 'authent':103C 'check':33B 'could':81C 'cve':12A,15A 'deploy':23B 'edit':11A,38B,76C,109C 'elev':50B,88C 'enabl':110C 'gain':49B 'grant':5A,87C 'host':26B 'ident':42B,80C 'includ':93C 'incorrect':63C 'instanc':100C 'issu':98C 'ldap':20B,102C 'login':10A,41B,79C,108C 'octopus':1A,18A,22B,28B,61C 'octopus-deploy':21B 'permiss':34B,51B,66C,89C 'proper':32B 'result':82C 'right':8A 'self':25B,106C 'self-host':24B 'self-servic':105C 'server':2A,19A,29B,62C 'servic':107C 'system':54B,94C 'use':46B,101C 'user':3A,37B,44B,70C,85C 'valid':64C 'vendor':27B 'version':59C 'via':9A 'would':72C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Octopus Server (Linux and Windows) using LDAP authentication with 'Allow users to edit their own logins' enabled: a user who can edit their own login identities can escalate up to system administrator. Octopus Cloud is already patched; instances without LDAP auth or with that setting off can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T08:29:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-21/","run_id":3521},"products":{"at":"2026-11-11T08:29:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-21/","run_id":3521},"how_to_check":{"at":"2026-11-11T08:29:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-21/","run_id":3521},"who_affected":{"at":"2026-11-11T08:29:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-21/","run_id":3521}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["high","ldap","octopusdeploy","selfhosted","vendor"],"campaign_type":null,"search_a":"'-105948':14A,17A '-2026':13A,16A 'admin':7A 'cve':12A,15A 'edit':11A 'grant':5A 'login':10A 'octopus':1A,18A 'right':8A 'server':2A,19A 'user':3A 'via':9A","search_b":"'access':56B 'administr':55B 'check':33B 'deploy':23B 'edit':38B 'elev':50B 'gain':49B 'host':26B 'ident':42B 'ldap':20B 'login':41B 'octopus':22B,28B 'octopus-deploy':21B 'permiss':34B,51B 'proper':32B 'self':25B 'self-host':24B 'server':29B 'system':54B 'use':46B 'user':37B,44B 'vendor':27B","search_c":"'access':96C 'administr':95C 'affect':58C,99C 'allow':73C 'assign':67C 'authent':103C 'could':81C 'edit':76C,109C 'elev':88C 'enabl':110C 'grant':87C 'ident':80C 'includ':93C 'incorrect':63C 'instanc':100C 'issu':98C 'ldap':102C 'login':79C,108C 'octopus':61C 'permiss':66C,89C 'result':82C 'self':106C 'self-servic':105C 'server':62C 'servic':107C 'system':94C 'use':101C 'user':70C,85C 'valid':64C 'version':59C 'would':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105948","severity":null,"published_at":"2026-11-11T08:17:16+00:00","modified_at":"2026-11-11T08:17:16+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105948:3521","url":"https://advisories.octopus.com/post/2026/sa2026-21/","severity":null,"published_at":"2026-11-11T08:29:01+00:00","modified_at":"2026-11-11T08:29:01+00:00","first_seen_at":"2026-11-11T08:29:01+00:00","fetched_at":"2026-11-11T08:29:01+00:00","note":"Read Octopus SA2026-21 (vendor). Versions, fix, mitigation from it; no exploitation known per vendor; no code check (setting lives in server, not repo).","cites":["https://advisories.octopus.com/post/2026/sa2026-21/"]}],"documents":[{"id":124006,"url":"https://advisories.octopus.com/post/2026/sa2026-21/","title":"Octopus Security Advisory 2026-21","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}