In certain versions of Octopus Server, creating a user invitation causes the invitation code to be logged in the audit event log. If the invitation is linked to a space, users with appropriate permissions in that space could read the invitation code from the audit log. An attacker who redeems the unclaimed invitation might escalate privileges depending on the permissions assigned to the invited user. This vulnerability has a high severity rating with a CVSS score of 7.7.