In affected versions of the Codefresh platform, a flaw in an API endpoint allows an authenticated user to obtain administrative privileges. The flaw involves improper authorization checks (CWE-266) and an authorization bypass (CWE-269), enabling a legitimate user to bypass normal authorization controls and elevate their permissions to the highest level, effectively granting full system control. This can enable arbitrary configuration changes, data access, or service disruption, representing a serious compromise of confidentiality, integrity, and availability for the platform and its hosted workloads.

The weakness affects Octopus Deploy's Codefresh platform. No specific product version information is available in the current advisory, so all installations of the platform should be evaluated for susceptibility.

The CVSS score of 8.6 indicates a high severity risk. The EPSS score is < 1%, indicating a low probability of exploitation, but the vulnerability requires an authenticated user, which can be easier to obtain than a purely remote exploit. The KEV catalog lists it as not publicly exploited at scale. Attackers would need to obtain valid user credentials, then craft a request to the vulnerable API endpoint to trigger the privilege escalation.