CVE-2018-9039

CVE-2018-9039 describes an authorization bypass vulnerability in Octopus Deploy versions 2.0 and later, prior to 2018.3.7. An authenticated user with variable edit permissions could improperly scope variables to environments beyond their authorized access, potentially exposing sensitive information from machines outside their team's intended scope. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and requires low privileges, leading to a high confidentiality impact. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.