Threats tagged 'ghsa-45mx-vf84-77ww'

A vulnerability in Posit Software, PBC RStudio Server and Posit Workbench before version 2026.08.0 allows remote authenticated users to bypass authorization controls in the localhost port-proxy feature. This flaw enables an attacker to access web applications and services bound to 127.0.0.1 under another user's session by using a proxy URL constructed from their own port token. Exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost. The vulnerability is due to the port token being an obfuscation measure rather than an authorization boundary, and the proxy does not verify port ownership by the requesting user.