Threat Intelligence Database

CVE-2026-114515 is a missing authorization vulnerability in schorschii OCO-Server versions prior to 1.2.3. It allows a valid Self-Service Portal user with limited permissions to queue unauthorized uninstall jobs on software packages across computers visible to their role. The flaw arises because permission checks for uninstall jobs do not properly remove denied package IDs, and the core logic treats the operation as system context, permitting the action unconditionally. This issue is fixed in version 1.2.3.

CVE-2026-61791 is a stored cross-site scripting (XSS) vulnerability in schorschii OCO-Server prior to version 1.2.1. The vulnerability arises from improper neutralization of script in HTML attributes, specifically in the Html::commandButton() function, which embeds a stored computer hostname into a JavaScript inline onclick handler with insufficient escaping. An attacker with access to the shared agent-registration-key and with self-registration enabled can inject malicious script via a crafted hostname. This script executes in an administrator's authenticated session when activating certain command buttons, potentially allowing abuse of administrative privileges such as deploying software jobs. The issue is fixed in version 1.2.1.