← Database

CVE-2022-2572

CRITICAL CVSS: 9.8 Published: 2022-11-01 Modified: 2026-06-17

Description

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.

Affected Platforms

Octopus Octopus Server

Weakness Type

CWE-287, CWE-287

References