Octopus Deploy’s Octopus Server contains a flaw in an API endpoint that incorrectly validates permissions. An authenticated user with low privileges can send a crafted request to change the expiration and revocation dates of signing keys used by the system. This does not expose the signing keys themselves, but it allows the attacker to shorten or extend the valid life of those keys, potentially disrupting the integrity of secure communications within the deployment environment.

The vulnerability affects the Octopus Deploy Octopus Server product. Specific version information is not provided in the CVE data; therefore it is unclear which releases contain the issue. Administrators should consult the vendor advisory or support resources to determine whether their server instance is affected.

The CVSS score of 2.3 indicates a low severity impact. The EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the API, so the attack vector is likely limited to users with API privileges. Even though the risk is reduced compared to more severe weaknesses, the ability to manipulate key lifetimes can undermine the trust model of the deployment pipeline and should be addressed promptly.