Permissions were not properly verified in the API on projects using version control in…
Priority LOW 21Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
Why it matters now
EPSS 0.00538 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Octopus Deploy | Octopus Server | < | — | No fix listed | CNA |
- Octopus Server VendorOctopus Deploy Affected < Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:* | 2021.3 to before 2021.3.12725; 2022.1 to before 2022.1.2454 | Vulnerable | Octopus Deploy |
- cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:* Versions 2021.3 to before 2021.3.12725; 2022.1 to before 2022.1.2454 Vulnerable ·Octopus Deploy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1502
- 2026-10-03 Alias added: GHSA-4r7w-cvqp-58f8
References
More Octopus Deploy Server vulnerabilities
- TI-2021-11814 Cleartext storage of sensitive information in Octopus Server CVSS 3.1HIGH 7.5
- TI-2021-11813 Cleartext storage of sensitive information in Octopus Server CVSS 3.1HIGH 7.5
- TI-2021-10722 Cleartext storage of sensitive information in multiple versions of Octopus Server where… CVSS 3.1HIGH 7.5
- TI-2019-11610 In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an… CVSS 3.0MEDIUM 6.5
- TI-2019-11609 In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured… CVSS 3.0MEDIUM 6.5
- TI-2019-13770 A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-1502 · CVE Program
- CVE-2022-1502 · NVD
- FIRST EPSS
- GHSA-4r7w-cvqp-58f8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences