CVE-2024-4226

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-30 · updated 2026-06-17
Weakness: CWE-276

Description

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed.

Affected products

Octopus Deploy Octopus Server: from 2022.2.6729 before 2022.2.7934; from 2022.3.348 before 2022.3.9163 — fixed in 2022.2.7934, 2022.3.9163

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2022.2.7934, 2022.3.9163. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/post/2024/SA2024-03/
https://advisories.octopus.com/post/2024/SA2024-03/

Get alerted when CVE-2024-4226 or the next vulnerability affects your stack