CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were stil…
Published: 2022-11-01 · CVSS: 9.8 · CVSS 3.1
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7