{"schema":"threatline.record/2","record":{"id":"CVE-2026-114515","aliases":["GHSA-34mv-3gjp-gf53"],"summary":"OCO-Server: Self-Service Portal uninstall-job authorization bypass","details":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.","categories":["Unclassified"],"product":"OCO-Server","vendor":"schorschii","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114515","source_modified_at":"2026-10-23T15:03:45.075Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"OCO-Server","vendor":"schorschii","versions":[{"status":"affected","version":"< 1.2.3"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53","source_modified_at":"2026-10-22T14:57:59Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"","name":"oco-server"},"range":"main branch, all versions as of 2026-09-03"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53","source_modified_at":"2026-10-22T14:57:59Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"","name":"oco-server"},"version":"1.2.3"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00213,"percentile":0.11071,"score_date":"2026-10-23"},"published_at":"2026-10-22T14:58:02.272Z","modified_at":"2026-10-23T15:03:45.075Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114515","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T15:03:45.075Z"},{"source":"GitHub Advisory Database","url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-22T14:57:59Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114515","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/schorschii/OCO-Server/commit/a0b3b6d2c22d01b196c22a9aa0e225429dbf09c8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/schorschii/OCO-Server/releases/tag/v1.2.3","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T14:48:18.973155Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T15:03:45.075Z","content_hash":"525530a3baad481267af0f1bdfdeb47570bdff42004588aadcfa933d0cdb24db"}}