{"id":"CVE-2026-93487","aliases":[],"cve":{"records":[{"id":"CVE-2026-93487","source":"Octopus","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T06:18:08.082Z","published":"2026-11-11T07:21:42.968Z","modified":"2026-11-11T07:21:42.968Z"}],"publishers":[{"name":"Octopus","role":"CNA","organizationId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","modified":"2026-11-11T07:21:42.968Z"}],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-20","tags":[],"source":"Octopus"}],"weaknesses":[{"id":"CWE-863","description":"CWE-863: Incorrect Authorization","source":"Octopus"}],"applicability":[],"prioritization":[]},"title":"In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could…","titleSource":"Octopus","descriptionSource":"Octopus","description":"In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.","score":7.1,"severity":"high","published":"2026-11-11T07:21:42.968Z","modified":"2026-11-11T07:21:42.968Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Octopus Deploy","name":"Octopus Server","platforms":["Windows","Linux"],"versions":[{"version":"2019.11.0","status":"affected","lessThan":"2026.2.13487","versionType":"custom"},{"version":"2026.3.0","status":"affected","lessThan":"2026.3.15863","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Octopus","url":"https://www.cve.org/CVERecord?id=CVE-2026-93487"}],"remediation":[],"references":["https://advisories.octopus.com/post/2026/sa2026-20"],"sources":[{"name":"CVE","id":"CVE-2026-93487","modified":"2026-11-11T07:21:42.968Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93487"}],"assessments":[{"source":"Octopus","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-11T23:04:43.736Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:00:31.976Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T15:10:34.899Z","attemptedAt":"2026-11-12T15:10:34.899Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T15:10:34.019Z","attemptedAt":"2026-11-12T15:10:34.019Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T15:10:33.548Z","attemptedAt":"2026-11-12T15:10:33.548Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T15:10:33.429Z","attemptedAt":"2026-11-12T15:10:33.429Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-123268","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123268","modified":"Nov 11, 2026, 7:21:42 AM","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-11-12T15:10:33.548Z"},{"source":"GitHub Advisory Database","id":"GHSA-h7qw-3f34-rjrw","url":"https://github.com/advisories/GHSA-h7qw-3f34-rjrw","modified":"2026-11-11T09:31:36Z","checkedAt":"2026-11-12T15:10:34.019Z"},{"source":"NVD","id":"CVE-2026-93487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93487","modified":"2026-11-11T08:17:19.213","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-12T15:10:34.899Z"}],"aiSummary":{"text":"Octopus Server versions 2019.11.0 to 2026.2.13487 and 2026.3.0 to 2026.3.15863 have incorrect validation of user permissions, potentially allowing unauthorized creation of project triggers, runbooks, or deployments. An attacker would need access to create project triggers. The impact is unauthorized actions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T00:41:03.634Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93487"}]}}