This vulnerability (CVE-2026-78210) involves an incorrect authorization flaw (CWE-863) in Octopus Server. Users granted specific scoped permission sets can execute arbitrary scripts in environments where they lack the required authorization. The vulnerability affects multiple version ranges of Octopus Server, specifically versions >=2019.5.9 <2026.1.11739, >=2026.2.0 <2026.2.13364, and >=2026.3.0 <2026.3.13951. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. There are no known exploits in the wild and no vendor advisory or patch links provided in the input data.

An attacker with certain scoped permissions can bypass intended authorization controls to execute arbitrary scripts in environments where they should not have such privileges. This could lead to unauthorized code execution within the Octopus Server environment, potentially impacting system integrity and security. However, exploitation requires some level of privilege (PR:L) and results in high impact on integrity (VI:H) with low impact on availability and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the input data, users should monitor Octopus Deploy's official channels for updates and apply any forthcoming patches promptly. In the meantime, review and restrict scoped permissions to the minimum necessary to reduce risk.