{"id":"CVE-2026-102478","published":"2026-10-07T02:16:56.320","lastModified":"2026-10-07T19:17:31.010","description":"In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1289"],"vendors":[],"products":[],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-11","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}