CVE-2022-2258: Octopus Server

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items

Affected products

• Octopus Octopus Server: from 2019.1.0, before 2022.3.11098 (fixed in 2022.3.11098); from 2022.4.791, before 2022.4.8463 (fixed in 2022.4.8463); from 2023.1.4189, before 2023.1.9672 (fixed in 2023.1.9672); version 2023.2.2028 only

Published 2023-03-13. Last modified 2026-06-17.