{"id":"CVE-2026-124627","kind":"vulnerability","aliases":["CVE-2026-124627"],"related":[],"title":"Octopus Server: new users can inherit another user's LDAP team permissions","description":"In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.","summary":"Octopus Server does not check the external identity linked to a newly registered user, so that user can receive the LDAP-mapped team memberships and permissions of a different user. The flaw only applies when LDAP authentication is enabled and LDAP groups are mapped to Octopus teams.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13526","2026.3.15926"],"affected":"all 3.x, 4.x, 2018.x-2025.x, 2026.1.x; 2026.2.x < 2026.2.13526; 2026.3.x < 2026.3.15926","ecosystem":"vendor"}],"ecosystems":[],"tags":["authorization","ldap","octopus-server","other","self-hosted"],"not_affected_if":["no-ldap-auth","no-ldap-team-mapping","octopus-cloud","patched-version"],"how_to_check":"1. Octopus Server version (Configuration > Diagnostics, or the footer): affected if it is any 3.x/4.x/2018-2025/2026.1.x, 2026.2.x before 2026.2.13526, or 2026.3.x before 2026.3.15926.\n2. Only exposed if LDAP authentication is enabled (Configuration > Settings > Authentication > LDAP) AND LDAP groups are mapped to Octopus teams (Configuration > Teams > external groups/roles).","fix":"Upgrade Octopus Server to 2026.2.13526 or later on the 2026.2 line, or 2026.3.15926 or later on 2026.3 (latest 2026.3.16117). All 3.x, 4.x, 2018-2025 and 2026.1.x must move to 2026.2.13526 or newer. Octopus Cloud is already patched.","status":"open","published_at":"2026-11-12T14:17:28+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:01+00:00","updated_at":"2026-11-12T14:40:01+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-12T14:39:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Octopus Server: new users can inherit another user's LDAP team permissions","impact":"high","summary":"Octopus Server does not check the external identity linked to a newly registered user, so that user can receive the LDAP-mapped team memberships and permissions of a different user. The flaw only applies when LDAP authentication is enabled and LDAP groups are mapped to Octopus teams.","audience":"businesses","category":"other","nicknames":[],"who_cares":["octopus-server","ldap","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"new account gains another user's team permissions in Octopus","analyst_note":"Find the affected version ranges and fixed version for CVE-2026-124627 in the NVD entry or the vendor advisory.","how_to_check":"- Check whether LDAP authentication is enabled and whether LDAP groups are mapped to Octopus teams in the Octopus Server configuration.\n- Confirm the Octopus Server version against the affected ranges; the sources do not list them here, so `unknown`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ldap-auth","no-ldap-team-mapping"],"who_is_affected":"Only Octopus Server instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams can be affected, since the flaw depends on those mappings handing out team permissions to new accounts. Instances using other login methods or without LDAP team mappings are not described as affected. The sources do not list affected version ranges.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00075,"input_tokens":4549,"output_tokens":590,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version ranges and fixed version for CVE-2026-124627 in the NVD entry or the vendor advisory.","search":"'-124627':15A,18A '-2026':14A,17A 'affect':79C,117C 'anoth':7A,112C 'appli':64B 'associ':109C 'authent':67B,121C 'author':21B 'check':34B 'could':96C 'cve':13A,16A 'differ':59B 'enabl':69B,122C 'extern':36B,88C 'flaw':62B 'group':72B,125C 'host':29B 'ident':37B,89C 'incorrect':84C 'inherit':6A 'instanc':118C 'issu':115C 'ldap':10A,22B,51B,66B,71B,104C,120C,124C 'ldap-map':50B,103C 'link':38B,90C 'map':52B,74B,105C,126C 'membership':54B,107C 'new':3A 'newli':41B,93C 'octopus':1A,19A,24B,30B,76B,82C,128C 'octopus-serv':23B 'permiss':12A,56B,110C 'receiv':48B,101C 'regist':42B,94C 'result':97C 'self':28B 'self-host':27B 'server':2A,20A,25B,31B,83C 'team':11A,53B,77B,106C,129C 'user':4A,8A,43B,46B,60B,95C,100C,113C 'valid':85C 'version':80C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Octopus Server instances (Linux and Windows) with LDAP authentication enabled and LDAP groups mapped to Octopus teams: a newly registered/invited user can receive another user's LDAP-mapped team memberships and permissions. Octopus Cloud is already patched. Instances without LDAP auth or without LDAP team mappings can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741},"products":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741},"mitigations":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741},"workarounds":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741},"how_to_check":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741},"who_affected":{"at":"2026-11-12T14:40:01Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-23/","run_id":3741}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["authorization","high","ldap","octopusserver","other","selfhosted"],"campaign_type":null,"search_a":"'-124627':15A,18A '-2026':14A,17A 'anoth':7A 'cve':13A,16A 'inherit':6A 'ldap':10A 'new':3A 'octopus':1A,19A 'permiss':12A 'server':2A,20A 'team':11A 'user':4A,8A","search_b":"'appli':64B 'authent':67B 'author':21B 'check':34B 'differ':59B 'enabl':69B 'extern':36B 'flaw':62B 'group':72B 'host':29B 'ident':37B 'ldap':22B,51B,66B,71B 'ldap-map':50B 'link':38B 'map':52B,74B 'membership':54B 'newli':41B 'octopus':24B,30B,76B 'octopus-serv':23B 'permiss':56B 'receiv':48B 'regist':42B 'self':28B 'self-host':27B 'server':25B,31B 'team':53B,77B 'user':43B,46B,60B","search_c":"'affect':79C,117C 'anoth':112C 'associ':109C 'authent':121C 'could':96C 'enabl':122C 'extern':88C 'group':125C 'ident':89C 'incorrect':84C 'instanc':118C 'issu':115C 'ldap':104C,120C,124C 'ldap-map':103C 'link':90C 'map':105C,126C 'membership':107C 'newli':93C 'octopus':82C,128C 'permiss':110C 'receiv':101C 'regist':94C 'result':97C 'server':83C 'team':106C,129C 'user':95C,100C,113C 'valid':85C 'version':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124627","severity":null,"published_at":"2026-11-12T14:17:28+00:00","modified_at":"2026-11-12T14:17:28+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124627:3741","url":"https://advisories.octopus.com/post/2026/sa2026-23/","severity":null,"published_at":"2026-11-12T14:40:01+00:00","modified_at":"2026-11-12T14:40:01+00:00","first_seen_at":"2026-11-12T14:40:01+00:00","fetched_at":"2026-11-12T14:40:01+00:00","note":"Read vendor advisory 2026-23 (Octopus). Affected/fixed versions and no-mitigation statement from vendor page; no exploitation known per vendor; not checked social.","cites":["https://advisories.octopus.com/post/2026/sa2026-23/"]}],"documents":[{"id":135688,"url":"https://advisories.octopus.com/post/2026/sa2026-23/","title":"Octopus Security Advisory 2026-23: LDAP identity injection during invitation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}