In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
NVD-CWE-noinfo