Threat database

CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server versions prior to 1.2.3 involving improper certificate validation in the Apple MDM enrollment endpoint. The vulnerability allows an attacker to forge enrollment requests using arbitrary self-signed certificates, bypassing proper certificate chain validation. This leads to issuance of a valid MDM identity certificate for a victim device, enabling device-record hijacking and impersonation of the victim device in MDM communications. Version 1.2.3 addresses this issue.

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

CVE-2026-61791 is a stored cross-site scripting (XSS) vulnerability in schorschii OCO-Server prior to version 1.2.1. The vulnerability arises from improper neutralization of script in HTML attributes, specifically in the Html::commandButton() function, which embeds a stored computer hostname into a JavaScript inline onclick handler with insufficient escaping. An attacker with access to the shared agent-registration-key and with self-registration enabled can inject malicious script via a crafted hostname. This script executes in an administrator's authenticated session when activating certain command buttons, potentially allowing abuse of administrative privileges such as deploying software jobs. The issue is fixed in version 1.2.1.