{"affected":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","source":"CNA: Octopus","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2022.1.3143","versionType":"custom"},{"lessThan":"2026.3.15875","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"cveId":"CVE-2026-96414","cwes":["CWE-649"],"description":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: Octopus","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794380633880,"publishedAt":1794380476258,"references":[{"source":"CNA: Octopus","tags":[],"url":"https://advisories.octopus.com/post/2026/sa2026-19"}],"remediation":[],"revision":"c608c0c379c8a2d49510b05dd7963c2bd6c2c03f67f2fa8b026ffdf20b271b45","sources":[{"modifiedAt":1794380633880,"name":"CNA: Octopus","retrievedAt":1794384528769,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96414"}],"ssvc":null,"status":"published","title":"CVE-2026-96414","updatedAt":1794384528769}