CVE-2026-12878: Authenticated user can utilize an API endpoint to elevate to Admin permissions in Octopus Deploy Codefresh

This vulnerability allows an authenticated user of Codefresh version 2.0.0 to leverage an API endpoint to gain administrative privileges. The flaw relates to improper authorization controls (CWE-269) that permit privilege escalation. The CVSS 4.0 base score is 8.6, indicating a high impact with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An attacker with valid user credentials can escalate their privileges to Admin, potentially gaining full control over the Codefresh platform instance. This can lead to unauthorized access, configuration changes, and compromise of the deployment environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious API usage related to privilege escalation attempts.