VULNERABILITY INTELLIGENCE

CVE-2017-15611

CVSS score6.5 MEDIUM

EPSS probability0.73%

CISA KEVNot currently listed

Published2017-10-19

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.

Weakness classification

CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references

cve@mitre.org — Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory