CVE-2022-1502: Octopus Server

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.

Affected products

• Octopus Server: from 2021.3, before 2021.3.12725 (fixed in 2021.3.12725); from 2022.1, before 2022.1.2454 (fixed in 2022.1.2454)

Published 2022-05-04. Last modified 2026-06-17.