CVE-2026-114515

Name of the Vulnerable Software and Affected Versions OCO-Server versions prior to 1.2.3

Description A valid Self-Service Portal user with permissions to create job containers and read visibility on a computer and package can queue unauthorized software-removal jobs. This occurs because requests to the self-service/ajax-handler/job-containers.php endpoint pass uninstall package assignment id[] values to the uninstallSelfService() function in lib/SelfService/CoreLogic.class.php. The permission-check loop in this function fails to remove rejected IDs from the $installationIds variable after denied METHOD DEPLOY checks. Subsequently, the original list is passed to the uninstall() function in lib/CoreLogic.class.php. Because the CoreLogic object is constructed with a null SystemUser, the checkPermission() function treats the operation as system context and permits it unconditionally. This allows the selection of readable installed-package assignments via enumerable computer package.id values, including those on computers belonging to other users.

Recommendations Update OCO-Server to version 1.2.3.