OCTOPUS SERVER · CVE-2026-124627 · Other
FIX → 2026.3.15926 +1 ✓ verified
Octopus Server does not check the external identity linked to a newly registered user, so that user can receive the LDAP-mapped team memberships and permissions of a different user. The flaw only applies when LDAP authentication is enabled and LDAP groups are mapped to Octopus teams.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Octopus Server instances (Linux and Windows) with LDAP authentication enabled and LDAP groups mapped to Octopus teams: a newly registered/invited user can receive another user's LDAP-mapped team memberships and permissions. Octopus Cloud is already patched. Instances without LDAP auth or without LDAP team mappings can skip it.
Not affected if no-ldap-auth, no-ldap-team-mapping, octopus-cloud, patched-version
Who cares authorization, ldap, octopus-server, self-hosted
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 2026.3.15926 +1
2026.2.13526 or later on the 2026.2 line, or 2026.3.15926 or later on 2026.3 (latest 2026.3.16117)2026.2.13526 or newer