CVE-2024-4226

3.5 lowEPSS 0.3%

Low (3.5) in octopus octopus server. EPSS 0.3% chance of exploitation in the next 30 days.

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2024-04-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

octopus:octopus_server

References

https://advisories.octopus.com/post/2024/SA2024-03/
https://advisories.octopus.com/post/2024/SA2024-03/

Check your stack JSON