CVE-2017-15611

MEDIUM

Octopus Deploy < 3.17.6 - Authenticated Privilege Escalation via User Invitation

Title source: llm

Description

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.

References (1)

Core 1

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://github.com/OctopusDeploy/Issues/issues/3864

Scores

CVSS v3 6.5

EPSS 0.0073

EPSS Percentile 49.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-732

Status published

Products (1)

octopus/octopus_deploy < 3.17.6

Published Oct 19, 2017

Tracked Since Feb 18, 2026