Live › vulnerability › CVE-2026-117341
Go to dashboardCreating a user invitation in affected self-hosted Octopus Server versions writes the invitation code to the audit event log. A user in the linked space with audit read permission can redeem an unclaimed invitation and escalate privileges, depending on the invited user's permissions. Vendor says no known mitigation and no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Teams running affected Octopus Server versions that send user invitations linked to a space. Exposure depends on who can read the audit event log and on the permissions granted to the invited user. Installations that never create invitations are not exposed by this flaw, as far as the sources say.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Octopus Server | vendor | all 2019.x-2025.x; 2026.x < 2026.2.13438; 2026.3 < 2026.3.15829 | 2026.2.13438, 2026.3.15829 |
2026.2.13438, and 2026.3 before 2026.3.158292026.3.15829 or later (latest 2026.3.15973), or 2026.2.13438 or later on the 2026.2 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
This page as .md · .json · in your agent: get_signal("CVE-2026-117341")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.