CVE-2026-114515: CWE-862: Missing Authorization in schorschii OCO-Server
Description
CVE-2026-114515 is a missing authorization vulnerability in schorschii OCO-Server versions prior to 1.2.3. It allows a valid Self-Service Portal user with limited permissions to queue unauthorized uninstall jobs on software packages across computers visible to their role. The flaw arises because permission checks for uninstall jobs do not properly remove denied package IDs, and the core logic treats the operation as system context, permitting the action unconditionally. This issue is fixed in version 1.2.3.
CVSS v3.1
Score 6.5medium
Affected software
schorschii
OCO-Server
pkg:github/schorschii/OCO-ServerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OCO-Server, a self-hosted endpoint management application, contains a missing authorization vulnerability (CWE-862) in versions before 1.2.3. A user with permission to create job containers and read visibility on computers and packages can queue uninstall jobs without having deploy permissions. The vulnerability exists because the permission-check loop in uninstallSelfService() continues after denied deploy permission checks without removing unauthorized package IDs from the uninstall list. The uninstall operation is then executed in a system context due to a null SystemUser object, causing unconditional permission granting. This allows unauthorized software removal jobs on resources visible to the user. The install path correctly aborts on denied deployment permission, preventing similar unauthorized installs. The issue is resolved in version 1.2.3.
Potential Impact
An attacker with limited permissions can perform unauthorized uninstall operations on software packages across computers they can view, potentially disrupting software availability or causing operational issues. The vulnerability does not impact confidentiality or availability directly but allows unauthorized integrity modification of managed software.
Mitigation Recommendations
This vulnerability is fixed in schorschii OCO-Server version 1.2.3. Users should upgrade to version 1.2.3 or later to remediate this issue. No other mitigation or workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-21T16:15:06.492Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ada28cd4d27ba8daa606ce9
Added to database: 10/22/2026, 15:16:29 UTC
Last enriched: 10/22/2026, 15:30:24 UTC
Last updated: 10/22/2026, 15:35:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.