CVE-2026-102478: CWE-1289: Improper Validation of Unsafe Equivalence in Input in Octopus Deploy Octopus Server

This vulnerability (CWE-1289) in Octopus Server involves improper validation of unsafe equivalence in input handling related to role modification. An authenticated user with role modification permissions can bypass protections designed to prevent access abuse, resulting in privilege escalation. Specifically, the attacker can weaken the built-in role protections and add their account to a privileged team, thereby gaining elevated privileges. The affected versions include 2023.2.945 up to but not including 2026.1.11768, 2026.2.0 up to but not including 2026.2.13408, and 2026.3.0 up to but not including 2026.3.15816.

An attacker with authenticated access and permission to modify roles can escalate their privileges by weakening built-in role protections and adding themselves to privileged teams. This could lead to unauthorized administrative access within Octopus Server, potentially compromising the integrity and security of the deployment environment.

Patch your Octopus Server installations to versions 2026.1.11768 or later for the 2026.1.x branch, 2026.2.13408 or later for the 2026.2.x branch, and 2026.3.15816 or later for the 2026.3.x branch. These versions contain fixes that address the improper validation vulnerability. Since no vendor advisory or patch links were provided, verify the availability of these updates with Octopus Deploy's official resources before applying.