Vulnerability Description
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-91778?
CVE-2026-91778 is a documented vulnerability. In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission valid...
How severe is CVE-2026-91778?
CVSS scoring is not yet available for CVE-2026-91778. Check NVD for updates.
Is there a patch for CVE-2026-91778?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.