---
id: "CVE-2026-105948"
page: "https://infrastack.ai/live/CVE-2026-105948"
kind: "vulnerability"
aliases: ["CVE-2026-105948"]
title: "Octopus Server: users can grant themselves admin rights via login edits"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13487", "2026.3.15909"], "affected": "> 2024.2.5035, < 2026.2.13487; >= 2026.3.0, < 2026.3.15909", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ldap", "octopus-deploy", "self-hosted", "vendor"]
not_affected_if: ["non-ldap-auth", "octopus-cloud", "self-service-login-editing-disabled"]
published_at: "2026-11-11T08:17:16+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:29:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105948", "first_seen_at": "2026-11-11T08:26:05+00:00"}, {"source": "analyst", "url": "https://advisories.octopus.com/post/2026/sa2026-21/", "first_seen_at": "2026-11-11T08:29:01+00:00", "cites": ["https://advisories.octopus.com/post/2026/sa2026-21/"]}]
exploit_sources: []
---

# Octopus Server: users can grant themselves admin rights via login edits

Link for people: https://infrastack.ai/live/CVE-2026-105948 (this .md is for agents)

Octopus Server does not properly check permissions when a user edits their own login identities. A user can use this to gain elevated permissions, up to system administrator access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected > 2024.2.5035, < 2026.2.13487; >= 2026.3.0, < 2026.3.15909 fixed 2026.2.13487, 2026.3.15909

## How to check

Check Octopus Server version: affected are 2024.2.x after 2024.2.5035, all 2024.3.x, 2024.4.x, 2025.x, 2026.1.x, 2026.2.x before 2026.2.13487, 2026.3.x before 2026.3.15909. Then check whether the LDAP auth provider is enabled and 'Allow users to edit their own logins' is on; if either is off you are not exposed. Review team membership and the audit log for LDAP identities recently added to user accounts.

## Fix

Upgrade Octopus Server to 2026.2.13487 or later (for 2024.x, 2025.x, 2026.1.x, 2026.2.x) or 2026.3.15909 or later (2026.3.x); vendor recommends latest 2026.3.16030. Workaround if you can't upgrade: turn off 'Allow users to edit their own logins'. Octopus Cloud already patched.

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105948
- 2026-11-11T08:29:01+00:00 analyst https://advisories.octopus.com/post/2026/sa2026-21/ — Read Octopus SA2026-21 (vendor). Versions, fix, mitigation from it; no exploitation known per vendor; no code check (setting lives in server, not repo).

## Documents

- [advisory] Octopus Security Advisory 2026-21 https://advisories.octopus.com/post/2026/sa2026-21/

## From the sources

In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_