CVE-2018-5706

8.8 highEPSS 1.0%

An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2018-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

octopus:octopus_deploy

References

https://github.com/OctopusDeploy/Issues/issues/4167
https://github.com/OctopusDeploy/Issues/issues/4167

Check your stack JSON