---
id: "CVE-2026-93487"
page: "https://infrastack.ai/live/CVE-2026-93487"
kind: "vulnerability"
aliases: ["CVE-2026-93487"]
title: "Octopus Server: permission check lets users run unauthorised runbooks and deployments"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13487", "2026.3.15863"], "affected": ">= 2019.11.0, < 2026.2.13487; >= 2026.3.0, < 2026.3.15863", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authorization", "ci-cd", "octopus-deploy", "runtime", "self-hosted"]
not_affected_if: ["no-project-triggers-granted", "octopus-cloud", "patched-version"]
published_at: "2026-11-11T08:17:19+00:00"
first_seen_at: "2026-11-11T08:26:06+00:00"
updated_at: "2026-11-11T08:28:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93487", "first_seen_at": "2026-11-11T08:26:06+00:00"}, {"source": "analyst", "url": "https://advisories.octopus.com/post/2026/sa2026-20/", "first_seen_at": "2026-11-11T08:28:52+00:00", "cites": ["https://advisories.octopus.com/post/2026/sa2026-20/"]}]
exploit_sources: []
---

# Octopus Server: permission check lets users run unauthorised runbooks and deployments

Link for people: https://infrastack.ai/live/CVE-2026-93487 (this .md is for agents)

Octopus Server does not properly validate permissions for users who create project triggers. A user with trigger rights can run runbooks or create deployments they are not authorised to perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected >= 2019.11.0, < 2026.2.13487; >= 2026.3.0, < 2026.3.15863 fixed 2026.2.13487, 2026.3.15863

## How to check

Find your Octopus Server version (Configuration > Diagnostics, or the installed package). You are affected if it is 2019.x after 2019.11.x, any 2020.x–2025.x, 2026.x before 2026.2.13487, or 2026.3 before 2026.3.15863. Also review which users hold project trigger creation rights.

## Fix

Upgrade Octopus Server to 2026.2.13487 or later on the 2019.x–2026.2 lines, or 2026.3.15863 or later on 2026.3 (latest is 2026.3.16030). Octopus Cloud is already patched.

## Timeline

- 2026-11-11T08:26:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93487
- 2026-11-11T08:28:52+00:00 analyst https://advisories.octopus.com/post/2026/sa2026-20/ — Octopus advisory 2026-20: affected/fixed versions, no known mitigation, no known exploitation. Vendor says no mitigation.

## Documents

- [advisory] Octopus Security Advisory 2026-20 https://advisories.octopus.com/post/2026/sa2026-20/

## From the sources

In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_