An authenticated user who can modify roles can bypass normal protection checks, weaken the built‑in role, and add their account to a privileged team. This flaw is caused by improper validation of unsafe equivalence in role‑modification inputs, allowing the attacker to evade authorization controls and elevate their privileges.

Octopus Deploy Octopus Server is affected. Specific version information is not provided in the advisory; any current installations that have not applied the vendor’s fix are vulnerable.

The CVSS score of 8.7 indicates high severity and the vulnerability is likely exploitable by an authenticated user with role‑management authority. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but the attacker still needs only legitimate credentials and authorization to modify roles to succeed. The exploit path is straightforward: log in, modify roles, and add the attacker to a privileged group, resulting in full control over the system.