CVE-2026-12702 - Vulnerability Details - OpenCVE

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Octopus	Octopus Server

No data.

No data.

References

Link	Providers
https://advisories.octopus.com/post/2026/sa2026-06

History

Mon, 27 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Octopus Octopus octopus Server
Vendors & Products		Octopus Octopus octopus Server

Sun, 26 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Title		Unauthorized Deployment Trigger via Insufficient Project Trigger Checks

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 24 Jul 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.
References		https://advisories.octopus.com/post/2026/sa2026-06
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Octopus

Published: 2026-07-24T08:29:31.719Z

Updated: 2026-07-24T12:36:31.660Z

Reserved: 2026-06-19T10:14:04.133Z

Link: CVE-2026-12702

Vulnrichment

Updated: 2026-07-24T12:36:23.557Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12702", "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "state": "PUBLISHED", "assignerShortName": "Octopus", "dateReserved": "2026-06-19T10:14:04.133Z", "datePublished": "2026-07-24T08:29:31.719Z", "dateUpdated": "2026-07-24T12:36:31.660Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "shortName": "Octopus", "dateUpdated": "2026-07-24T08:29:31.719Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment"}]}], "affected": [{"vendor": "Octopus Deploy", "product": "Octopus Server", "platforms": ["Windows", "Linux"], "versions": [{"status": "affected", "version": "2023.0.0", "lessThan": "2026.1.11587", "versionType": "custom"}, {"status": "affected", "version": "2026.1.0", "lessThan": "2026.1.11587", "versionType": "custom"}, {"status": "affected", "version": "2026.2.0", "lessThan": "2026.2.13190", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment."}]}], "references": [{"url": "https://advisories.octopus.com/post/2026/sa2026-06"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "This vulnerability was found by hackingsal", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T12:35:49.746217Z", "id": "CVE-2026-12702", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T12:36:31.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T12:35:49.746217Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T12:36:23.557Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability was found by hackingsal"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Octopus Deploy", "product": "Octopus Server", "versions": [{"status": "affected", "version": "2023.0.0", "lessThan": "2026.1.11587", "versionType": "custom"}, {"status": "affected", "version": "2026.1.0", "lessThan": "2026.1.11587", "versionType": "custom"}, {"status": "affected", "version": "2026.2.0", "lessThan": "2026.2.13190", "versionType": "custom"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://advisories.octopus.com/post/2026/sa2026-06"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.", "supportingMedia": [{"type": "text/html", "value": "In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment"}]}], "providerMetadata": {"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "shortName": "Octopus", "dateUpdated": "2026-07-24T08:29:31.719Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12702", "state": "PUBLISHED", "dateUpdated": "2026-07-24T12:36:31.660Z", "dateReserved": "2026-06-19T10:14:04.133Z", "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "datePublished": "2026-07-24T08:29:31.719Z", "assignerShortName": "Octopus"}, "dataVersion": "5.2"}