CVE-2022-2828: Octopus Server

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Affected products

• Octopus Octopus Server: from 2022.1.2121, up to and including 2022.1.3135; from 2022.2.0, up to and including 2022.2.7897; from 2022.3.0, up to and including 2022.3.10586

Published 2022-10-13. Last modified 2026-06-17.