{"id":"CVE-2026-93487","kind":"vulnerability","aliases":["CVE-2026-93487"],"related":[],"title":"Octopus Server: permission check lets users run unauthorised runbooks and deployments","description":"In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.","summary":"Octopus Server does not properly validate permissions for users who create project triggers. A user with trigger rights can run runbooks or create deployments they are not authorised to perform.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13487","2026.3.15863"],"affected":">= 2019.11.0, < 2026.2.13487; >= 2026.3.0, < 2026.3.15863","ecosystem":"vendor"}],"ecosystems":[],"tags":["authorization","ci-cd","octopus-deploy","runtime","self-hosted"],"not_affected_if":["no-project-triggers-granted","octopus-cloud","patched-version"],"how_to_check":"Find your Octopus Server version (Configuration > Diagnostics, or the installed package). You are affected if it is 2019.x after 2019.11.x, any 2020.x–2025.x, 2026.x before 2026.2.13487, or 2026.3 before 2026.3.15863. Also review which users hold project trigger creation rights.","fix":"Upgrade Octopus Server to 2026.2.13487 or later on the 2019.x–2026.2 lines, or 2026.3.15863 or later on 2026.3 (latest is 2026.3.16030). Octopus Cloud is already patched.","status":"open","published_at":"2026-11-11T08:17:19+00:00","first_seen_at":"2026-11-11T08:26:06+00:00","triaged_at":"2026-11-11T08:27:50+00:00","updated_at":"2026-11-11T08:28:52+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-11T08:27:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: permission check lets users run unauthorised runbooks and deployments","impact":"medium","summary":"Octopus Server does not properly validate permissions for users who create project triggers. A user with trigger rights can run runbooks or create deployments they are not authorised to perform.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["octopus-deploy","self-hosted","ci-cd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user runs unauthorised runbooks or creates deployments","analyst_note":"Check the Octopus Server advisory and NVD entry for affected and fixed version ranges and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-project-triggers-granted"],"who_is_affected":"Teams that run Octopus Server for deployments and give users the ability to create project triggers. Users without trigger permissions are not described as exposed by the sources. Whether a specific version is affected is not stated in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4519,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Octopus Server advisory and NVD entry for affected and fixed version ranges and any mitigation.","search":"'-2026':13A,16A '-93487':14A,17A 'abl':90C 'affect':62C 'allow':78C 'assign':72C 'author':20B 'authoris':58B,100C 'cd':23B 'check':4A 'ci':22B 'ci-cd':21B 'could':84C 'creat':41B,53B,81C,95C 'cve':12A,15A 'deploy':11A,26B,54B,96C 'host':30B 'incorrect':67C 'let':5A 'octopus':1A,18A,25B,31B,65C 'octopus-deploy':24B 'perform':60B,102C 'permiss':3A,37B,71C 'project':42B,82C 'proper':35B 'result':85C 'right':48B 'run':7A,50B,92C 'runbook':9A,51B,93C 'runtim':27B 'self':29B 'self-host':28B 'server':2A,19A,32B,66C 'trigger':43B,47B,83C 'unauthoris':8A 'user':6A,39B,45B,75C,88C 'valid':36B,68C 'version':63C 'would':77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Octopus Server (Linux and Windows) where users have been given permission to create project triggers. Such a user can run runbooks or create deployments they are not authorised to perform. Octopus Cloud instances are already updated; installs on 2026.2.13487+ or 2026.3.15863+ can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T08:28:52Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-20/","run_id":3519},"products":{"at":"2026-11-11T08:28:52Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-20/","run_id":3519},"mitigations":{"at":"2026-11-11T08:28:52Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-20/","run_id":3519},"workarounds":{"at":"2026-11-11T08:28:52Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-20/","run_id":3519},"who_affected":{"at":"2026-11-11T08:28:52Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-20/","run_id":3519}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["authorization","cicd","high","octopusdeploy","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-93487':14A,17A 'check':4A 'cve':12A,15A 'deploy':11A 'let':5A 'octopus':1A,18A 'permiss':3A 'run':7A 'runbook':9A 'server':2A,19A 'unauthoris':8A 'user':6A","search_b":"'author':20B 'authoris':58B 'cd':23B 'ci':22B 'ci-cd':21B 'creat':41B,53B 'deploy':26B,54B 'host':30B 'octopus':25B,31B 'octopus-deploy':24B 'perform':60B 'permiss':37B 'project':42B 'proper':35B 'right':48B 'run':50B 'runbook':51B 'runtim':27B 'self':29B 'self-host':28B 'server':32B 'trigger':43B,47B 'user':39B,45B 'valid':36B","search_c":"'abl':90C 'affect':62C 'allow':78C 'assign':72C 'authoris':100C 'could':84C 'creat':81C,95C 'deploy':96C 'incorrect':67C 'octopus':65C 'perform':102C 'permiss':71C 'project':82C 'result':85C 'run':92C 'runbook':93C 'server':66C 'trigger':83C 'user':75C,88C 'valid':68C 'version':63C 'would':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93487","severity":null,"published_at":"2026-11-11T08:17:19+00:00","modified_at":"2026-11-11T08:17:19+00:00","first_seen_at":"2026-11-11T08:26:06+00:00","fetched_at":"2026-11-11T08:26:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93487:3519","url":"https://advisories.octopus.com/post/2026/sa2026-20/","severity":null,"published_at":"2026-11-11T08:28:52+00:00","modified_at":"2026-11-11T08:28:52+00:00","first_seen_at":"2026-11-11T08:28:52+00:00","fetched_at":"2026-11-11T08:28:52+00:00","note":"Octopus advisory 2026-20: affected/fixed versions, no known mitigation, no known exploitation. Vendor says no mitigation.","cites":["https://advisories.octopus.com/post/2026/sa2026-20/"]}],"documents":[{"id":124005,"url":"https://advisories.octopus.com/post/2026/sa2026-20/","title":"Octopus Security Advisory 2026-20","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}