CVE-2026-4881 MEDIUM

CVE-2026-4881

Vendor Octopus Deploy
Product Octopus Server
Published June 4, 2026
Last update June 4, 2026

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.

Key dates

02Disclosure timeline

June 4, 2026 CVE published
June 4, 2026 Record updated