CVE-2026-114515: OCO-Server: Self-Service Portal uninstall-job authorization bypass
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to self-service/ajax-handler/job-containers.php pass uninstallpackageassignmentid[] values to lib/SelfService/CoreLogic.class.php::uninstallSelfService(). Its permission-check loop continues after denied METHODDEPLOY checks without removing rejected IDs from $installationIds, then passes the original list to lib/CoreLogic.class.php::uninstall(). The CoreLogic object is constructed with a null SystemUser, causing lib/CoreLogic.class.php::checkPermission() to treat the operation as system context and unconditionally permit it. Enumerable computerpackage.id values allow selection of readable installed-package assignments, including those on other users' computers. The deploySelfService() install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OCO-Serverto a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Frequently Asked Questions
Which users can exploit this issue?
A valid Self-Service Portal user must be able to create job containers and have read visibility on both a computer and a package. They do not need deploy permission for the selected resources.
Can this affect computers assigned to other users?
Yes. If the user can read the relevant installed-package assignment, enumerable computer_package.id values can be used to target assignments on other users' computers.
Are resources that the user cannot read exposed?
No. The described issue does not bypass read-permission checks, so computers and packages without read visibility remain blocked.
Is installation affected in the same way as uninstallation?
No. The Self-Service install path aborts when deployment permission is denied; the authorization bypass is specific to the uninstall path.
What version addresses the issue?
The issue affects OCO-Server versions prior to 1.2.3. Updating to version 1.2.3 or later addresses the reported vulnerability.