Octopus: >> Octopus Server >> 2025.3.14731 Security Vulnerabilities
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
CVSS Score
6.0
EPSS Score
0.002
Published
2026-06-04
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
CVSS Score
2.3
EPSS Score
0.002
Published
2026-03-05