CVE-2026-124627 Privilege escalation in Octopus Server
Octopus Server users with LDAP authentication and LDAP-mapped teams may receive another user's LDAP-mapped team memberships and permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-124627?
CVE-2026-124627 is a high-severity privilege escalation vulnerability in Octopus Server, published on 12 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams.
Weakness: CWE-863
Which versions are affected by CVE-2026-124627?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-124627?
No fix has been published for CVE-2026-124627 yet. Limit exposure of the affected software until one is available.
Upgrade, and run services with the fewest rights they need. More about Privilege escalation.
Is CVE-2026-124627 being exploited?
There is no known exploitation of CVE-2026-124627 in the wild and no public exploit code.
Sources
Also known as GHSA-8wrj-pg56-7v73.