CVE-2026-78210

{
  "etk_id": "ETK-2026-206",
  "cve_id": "CVE-2026-78210",
  "display_id": "CVE-2026-78210",
  "ghsa_id": "GHSA-rm37-9r6w-4vwr",
  "euvd_id": "EUVD-2026-90474",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Octopus Deploy Octopus Server",
  "summary": "Affected Octopus Server versions do not correctly enforce environment authorization for some scoped permission assignments. An authenticated user with an affected scoped permission set may run scripts in an environment they are not authorized to access.",
  "mitigation": "Upgrade Octopus Server to 2026.1.11739, 2026.2.13364, or 2026.3.13951, as appropriate for your release line. Review scoped permission assignments and restrict script execution access until upgrades are complete.",
  "vendor": "Octopus Deploy",
  "product": "Octopus Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2019.5.9, < 2026.1.11739",
        ">= 2026.2.0, < 2026.2.13364",
        ">= 2026.3.0, < 2026.3.13951"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.1.11739",
        "2026.2.13364",
        "2026.3.13951"
      ],
      "package_name": "Octopus Server",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1633,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 43.49358156666667,
  "t0_at": "2026-10-01T04:36:23.243000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T04:36:23.243000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T04:36:23.243000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78210"
    }
  }
}