{"id":"CVE-2026-124628","kind":"vulnerability","aliases":["CVE-2026-124628"],"related":[],"title":"Octopus Server: LDAP identity edits bypass admin lock, enabling privilege escalation","description":"In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.","summary":"Octopus Server did not properly check changes a user made to their own LDAP identity, so users could edit it even when an administrator had disabled self-service identity editing. This can add the user to teams mapped to LDAP groups they do not belong to, and can escalate to full administrator rights if those teams are privileged.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13526","2026.3.15936"],"affected":"2018.3.x - 2026.1.x; 2026.2.x < 2026.2.13526; 2026.3.x < 2026.3.15936","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ldap","octopus-deploy","self-hosted","vendor"],"not_affected_if":["no-group-mapping","no-ldap"],"how_to_check":"- Find the Octopus Server version (Configuration > Diagnostics, or the footer). Affected: any 2018.3 to 2026.1 release, 2026.2.x before 2026.2.13526, 2026.3.x before 2026.3.15936.\n- Confirm LDAP authentication is enabled and self-service identity editing is disabled by an administrator.\n- Review teams mapped to external LDAP groups, especially privileged ones, for unexpected members.","fix":"Upgrade Octopus Server to 2026.2.13526 or later in the 2026.2 line, or 2026.3.15936 or later in the 2026.3 line. Vendor recommends the latest, 2026.3.16117. Versions before 2026.2 (2018.3 to 2026.1) must move to 2026.2.13526 or greater.","status":"open","published_at":"2026-11-12T14:17:28+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:01+00:00","updated_at":"2026-11-12T14:40:05+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-12T14:39:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: LDAP identity edits bypass admin lock, enabling privilege escalation","impact":"high","summary":"Octopus Server did not properly check changes a user made to their own LDAP identity, so users could edit it even when an administrator had disabled self-service identity editing. This can add the user to teams mapped to LDAP groups they do not belong to, and can escalate to full administrator rights if those teams are privileged.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["octopus-deploy","self-hosted","ldap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"user gains team membership and possibly full administrator privileges","analyst_note":"Find the affected and fixed Octopus Server versions from the vendor advisory and NVD configuration data; the sources here give none.","how_to_check":"- Check the Octopus Server version under the Configuration or About page and compare it with the affected range in the NVD entry\n- Confirm whether LDAP authentication is enabled and whether self-service identity editing is turned off in settings\n- Review team membership for teams mapped to external LDAP groups","plain_action":"","product_name":"Octopus Server","needs_analyst":true,"not_affected_if":["no-ldap","no-group-mapping"],"who_is_affected":"Teams running a self-hosted Octopus Server that authenticates users through LDAP and maps LDAP groups to Octopus teams are exposed. Instances without LDAP, or without LDAP group-to-team mappings, are less likely to be affected. The sources do not give affected version numbers or a fixed release.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4571,"output_tokens":623,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Octopus Server versions from the vendor advisory and NVD configuration data; the sources here give none.","search":"'-124628':14A,17A '-2026':13A,16A 'add':61B 'admin':7A 'administr':51B,80B,114C,147C 'affect':88C 'allow':105C 'belong':73B,140C 'bypass':6A 'chang':34B,96C 'check':33B 'could':45B,123C 'cve':12A,15A 'deploy':23B 'disabl':53B,116C 'edit':5A,46B,58B,108C,121C 'enabl':9A 'escal':11A,77B,144C 'even':48B,111C 'extern':134C 'full':79B,146C 'gain':128C 'group':69B,136C 'host':26B 'ident':4A,42B,57B,104C,110C,120C 'incorrect':93C 'ldap':3A,20B,41B,68B,103C,135C 'lock':8A 'made':37B,99C 'map':66B,132C 'membership':129C 'octopus':1A,18A,22B,28B,91C 'octopus-deploy':21B 'potenti':143C 'privileg':10A,86B,148C,155C 'proper':32B 'result':124C 'right':81B 'self':25B,55B,118C 'self-host':24B 'self-servic':54B,117C 'server':2A,19A,29B,92C 'servic':56B,119C 'team':65B,84B,131C,153C 'user':36B,44B,63B,98C,127C 'valid':94C 'vendor':27B 'version':89C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Octopus Server (Linux and Windows) using LDAP authentication with LDAP groups mapped to Octopus teams. A user can edit their own LDAP identity even when an administrator disabled that, and join teams mapped to groups they are not in, up to full administrator if a mapped team is privileged. Instances without LDAP or without group-to-team mappings can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T14:40:05Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-24/","run_id":3740},"products":{"at":"2026-11-12T14:40:05Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-24/","run_id":3740},"how_to_check":{"at":"2026-11-12T14:40:05Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-24/","run_id":3740},"who_affected":{"at":"2026-11-12T14:40:05Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-24/","run_id":3740}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["high","ldap","octopusdeploy","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124628':14A,17A '-2026':13A,16A 'admin':7A 'bypass':6A 'cve':12A,15A 'edit':5A 'enabl':9A 'escal':11A 'ident':4A 'ldap':3A 'lock':8A 'octopus':1A,18A 'privileg':10A 'server':2A,19A","search_b":"'add':61B 'administr':51B,80B 'belong':73B 'chang':34B 'check':33B 'could':45B 'deploy':23B 'disabl':53B 'edit':46B,58B 'escal':77B 'even':48B 'full':79B 'group':69B 'host':26B 'ident':42B,57B 'ldap':20B,41B,68B 'made':37B 'map':66B 'octopus':22B,28B 'octopus-deploy':21B 'privileg':86B 'proper':32B 'right':81B 'self':25B,55B 'self-host':24B 'self-servic':54B 'server':29B 'servic':56B 'team':65B,84B 'user':36B,44B,63B 'vendor':27B","search_c":"'administr':114C,147C 'affect':88C 'allow':105C 'belong':140C 'chang':96C 'could':123C 'disabl':116C 'edit':108C,121C 'escal':144C 'even':111C 'extern':134C 'full':146C 'gain':128C 'group':136C 'ident':104C,110C,120C 'incorrect':93C 'ldap':103C,135C 'made':99C 'map':132C 'membership':129C 'octopus':91C 'potenti':143C 'privileg':148C,155C 'result':124C 'self':118C 'self-servic':117C 'server':92C 'servic':119C 'team':131C,153C 'user':98C,127C 'valid':94C 'version':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124628","severity":null,"published_at":"2026-11-12T14:17:28+00:00","modified_at":"2026-11-12T14:17:28+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124628:3740","url":"https://advisories.octopus.com/post/2026/sa2026-24/","severity":null,"published_at":"2026-11-12T14:40:05+00:00","modified_at":"2026-11-12T14:40:05+00:00","first_seen_at":"2026-11-12T14:40:05+00:00","fetched_at":"2026-11-12T14:40:05+00:00","note":"Vendor advisory 2026-24 read: affected/fixed versions; vendor says no known mitigation and no known exploitation.","cites":["https://advisories.octopus.com/post/2026/sa2026-24/"]}],"documents":[{"id":135687,"url":"https://advisories.octopus.com/post/2026/sa2026-24/","title":"Octopus Security Advisory 2026-24","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}