{"id":"CVE-2026-114515","kind":"vulnerability","aliases":["CVE-2026-114515"],"related":[],"title":"OCO-Server: Self-Service users can queue unauthorized software uninstall jobs","description":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.","summary":"OCO-Server, a self-hosted endpoint management application, lets a Self-Service Portal user with job-container permission queue uninstall jobs for packages they lack deploy rights to. The permission check in the uninstall path continues after denials and runs under a null system user, so removals can reach computers visible to the user's role.","severity":"medium","cvss":6.5,"epss":0.00213,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint-management","mdm","package","self-hosted"],"not_affected_if":["self-service-portal-disabled","version-1.2.3-or-later"],"how_to_check":"- Check the installed OCO-Server version against `1.2.3` (the sources say the fix is in 1.2.3, but no command for reading the version is given: unknown)\n- Check whether Self-Service Portal users hold job-container permission and can see other users' computers: unknown","fix":"- Upgrade OCO-Server to `1.2.3` or later","status":"open","published_at":"2026-10-22T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:47:23+00:00","updated_at":"2026-10-25T03:47:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OCO-Server to `1.2.3` or later","reach":"network","title":"OCO-Server: Self-Service users can queue unauthorized software uninstall jobs","impact":"medium","summary":"OCO-Server, a self-hosted endpoint management application, lets a Self-Service Portal user with job-container permission queue uninstall jobs for packages they lack deploy rights to. The permission check in the uninstall path continues after denials and runs under a null system user, so removals can reach computers visible to the user's role.","category":"package","nicknames":[],"who_cares":["self-hosted","endpoint-management","mdm"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated portal user removes software on computers they can see","analyst_note":"","how_to_check":"- Check the installed OCO-Server version against `1.2.3` (the sources say the fix is in 1.2.3, but no command for reading the version is given: unknown)\n- Check whether Self-Service Portal users hold job-container permission and can see other users' computers: unknown","needs_analyst":false,"not_affected_if":["self-service-portal-disabled","version-1.2.3-or-later"],"who_is_affected":"Teams running OCO-Server before 1.2.3 with the Self-Service Portal enabled, where portal users can create job containers and read computers and packages. Exposure depends on what roles those users hold; installations without Self-Service Portal users are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3692,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114515':16A,19A '-2026':15A,18A '/ajax-handler/job-containers.php':148C '1.2.3':110C,262C 'abort':228C 'across':247C 'act':252C 'allow':209C 'applic':37B,98C 'assign':152C,216C 'block':239C 'caus':192C 'check':62B,161C,168C 'checkpermiss':194C 'comput':81B,100C,129C,222C 'computer_package.id':207C 'construct':187C 'contain':48B,123C 'context':201C 'continu':67B,163C 'corelog':184C 'creat':121C 'cve':14A,17A 'deni':165C,230C 'denial':69B 'deploy':57B,103C,138C,167C,231C 'deployselfservic':224C 'devic':106C 'endpoint':21B,35B,96C 'endpoint-manag':20B 'enumer':206C 'fix':259C 'host':27B,34B,95C 'id':153C,172C 'includ':217C 'instal':214C,225C 'installationid':174C 'installed-packag':213C 'instead':227C 'inventori':101C 'issu':257C 'job':13A,47B,52B,122C,136C,246C 'job-contain':46B 'lack':56B,235C 'let':38B 'lib/corelogic.class.php':181C,193C 'lib/selfservice/corelogic.class.php':156C 'list':179C 'loop':162C 'manag':22B,36B,97C,107C 'mdm':23B 'method':166C 'mobil':105C 'null':74B,190C 'object':185C 'oco':2A,29B,89C 'oco-serv':1A,28B,88C 'oper':198C 'origin':178C 'packag':24B,54B,131C,151C,215C 'pass':149C,176C 'path':66B,226C 'permiss':49B,61B,119C,139C,160C,232C,237C 'permission-check':159C 'permit':204C,241C 'portal':43B,116C 'prior':108C 'queue':9A,50B,133C 'reach':80B 'read':125C,236C 'readabl':212C 'reject':171C 'remain':238C 'remov':78B,170C,245C 'request':143C 'resourc':142C,234C,248C 'right':58B 'role':87B,255C 'run':71B 'select':210C 'self':5A,26B,33B,41B,94C,114C,146C 'self-host':25B,32B,93C 'self-servic':4A,40B,113C,145C 'server':3A,30B,90C 'servic':6A,42B,115C,147C 'softwar':11A,102C,244C 'software-remov':243C 'system':75B,200C 'systemus':191C 'treat':196C 'unauthor':10A,242C 'uncondit':203C 'uninstal':12A,51B,65B,135C,150C,182C 'uninstallselfservic':157C 'user':7A,44B,76B,85B,117C,221C,253C 'valid':112C 'valu':154C,208C 'version':261C 'visibl':82B,126C,249C 'without':137C,169C","nicknames":[],"mitigations":[],"who_affected":"Teams running OCO-Server before 1.2.3 with the Self-Service Portal enabled, where portal users can create job containers and read computers and packages. Exposure depends on what roles those users hold; installations without Self-Service Portal users are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114515","severity":null,"published_at":"2026-10-22T15:17:05+00:00","modified_at":"2026-10-23T15:17:26+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114515","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114515","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}