{"id":"CVE-2026-96414","aliases":[],"cve":{"records":[{"id":"CVE-2026-96414","source":"Octopus","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-23T05:15:29.421Z","published":"2026-11-11T07:01:16.258Z","modified":"2026-11-11T07:03:53.880Z"}],"publishers":[{"name":"Octopus","role":"CNA","organizationId":"6f4f8c89-ef06-4bae-a2a5-6734ddf76272","modified":"2026-11-11T07:03:53.880Z"}],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-19","tags":[],"source":"Octopus"}],"weaknesses":[{"id":"CWE-649","description":"CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking","source":"Octopus"}],"applicability":[],"prioritization":[]},"title":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions…","titleSource":"Octopus","descriptionSource":"Octopus","description":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.","score":8.7,"severity":"high","published":"2026-11-11T07:01:16.258Z","modified":"2026-11-11T07:03:53.880Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Octopus Deploy","name":"Octopus Server","platforms":["Windows","Linux"],"versions":[{"version":"2022.1.3143","status":"affected","lessThan":"2026.2.13487","versionType":"custom"},{"version":"2026.3.0","status":"affected","lessThan":"2026.3.15875","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Octopus","url":"https://www.cve.org/CVERecord?id=CVE-2026-96414"}],"remediation":[],"references":["https://advisories.octopus.com/post/2026/sa2026-19"],"sources":[{"name":"CVE","id":"CVE-2026-96414","modified":"2026-11-11T07:03:53.880Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96414"}],"assessments":[{"source":"Octopus","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-11-11T23:04:48.223Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:50:32.984Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T15:15:34.551Z","attemptedAt":"2026-11-12T15:15:34.551Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T15:15:32.802Z","attemptedAt":"2026-11-12T15:15:32.802Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T15:15:32.801Z","attemptedAt":"2026-11-12T15:15:32.801Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T15:15:32.802Z","attemptedAt":"2026-11-12T15:15:32.802Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-123267","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123267","modified":"Nov 11, 2026, 7:03:53 AM","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-12T15:15:32.801Z"},{"source":"GitHub Advisory Database","id":"GHSA-66h9-x6fw-797g","url":"https://github.com/advisories/GHSA-66h9-x6fw-797g","modified":"2026-11-11T09:31:36Z","checkedAt":"2026-11-12T15:15:32.802Z"},{"source":"NVD","id":"CVE-2026-96414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96414","modified":"2026-11-11T08:17:19.357","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-12T15:15:34.551Z"}],"aiSummary":{"text":"Octopus Server versions 2022.1.3143 to 2026.2.13487 and 2026.3.0 to 2026.3.15875 have insufficient authentication cookie protection and incorrect permission validation, potentially allowing users to escalate privileges to Administrator. An attacker needs access to a user account with view permissions for users or audit events. The impact is privilege escalation.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T00:41:06.265Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96414"}]}}