---
id: "CVE-2026-124628"
page: "https://infrastack.ai/live/CVE-2026-124628"
kind: "vulnerability"
aliases: ["CVE-2026-124628"]
title: "Octopus Server: LDAP identity edits bypass admin lock, enabling privilege escalation"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13526", "2026.3.15936"], "affected": "2018.3.x - 2026.1.x; 2026.2.x < 2026.2.13526; 2026.3.x < 2026.3.15936", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ldap", "octopus-deploy", "self-hosted", "vendor"]
not_affected_if: ["no-group-mapping", "no-ldap"]
published_at: "2026-11-12T14:17:28+00:00"
first_seen_at: "2026-11-12T14:38:37+00:00"
updated_at: "2026-11-12T14:40:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124628", "first_seen_at": "2026-11-12T14:38:37+00:00"}, {"source": "analyst", "url": "https://advisories.octopus.com/post/2026/sa2026-24/", "first_seen_at": "2026-11-12T14:40:05+00:00", "cites": ["https://advisories.octopus.com/post/2026/sa2026-24/"]}]
exploit_sources: []
---

# Octopus Server: LDAP identity edits bypass admin lock, enabling privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-124628 (this .md is for agents)

Octopus Server did not properly check changes a user made to their own LDAP identity, so users could edit it even when an administrator had disabled self-service identity editing. This can add the user to teams mapped to LDAP groups they do not belong to, and can escalate to full administrator rights if those teams are privileged.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected 2018.3.x - 2026.1.x; 2026.2.x < 2026.2.13526; 2026.3.x < 2026.3.15936 fixed 2026.2.13526, 2026.3.15936

## How to check

- Find the Octopus Server version (Configuration > Diagnostics, or the footer). Affected: any 2018.3 to 2026.1 release, 2026.2.x before 2026.2.13526, 2026.3.x before 2026.3.15936.
- Confirm LDAP authentication is enabled and self-service identity editing is disabled by an administrator.
- Review teams mapped to external LDAP groups, especially privileged ones, for unexpected members.

## Fix

Upgrade Octopus Server to 2026.2.13526 or later in the 2026.2 line, or 2026.3.15936 or later in the 2026.3 line. Vendor recommends the latest, 2026.3.16117. Versions before 2026.2 (2018.3 to 2026.1) must move to 2026.2.13526 or greater.

## Timeline

- 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124628
- 2026-11-12T14:40:05+00:00 analyst https://advisories.octopus.com/post/2026/sa2026-24/ — Vendor advisory 2026-24 read: affected/fixed versions; vendor says no known mitigation and no known exploitation.

## Documents

- [advisory] Octopus Security Advisory 2026-24 https://advisories.octopus.com/post/2026/sa2026-24/

## From the sources

In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_