CVE-2026-117466

HighCVSS 8.6/10Last modified Nov 4, 2026

Description

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 27, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1174686.5Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An autCVE-2026-1174695.4Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operationsCVE-2026-117476.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected CVE-2026-1174706.5Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticatCVE-2026-1174715.4Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to tCVE-2026-1174724.3Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixedCVE-2026-1174776.1KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to bCVE-2026-117486.9A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm suCVE-2026-117497.6A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing repCVE-2026-1174938.3Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an CVE-2026-1174993.7@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that rCVE-2026-11757.5A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component Gr
CVE-2026-117466: High severity, CVSS 8.6 | Vulnix