Unauthorized Software Removal in OCO-Server by Schorschii

CVE-2026-114515

What is CVE-2026-114515?

OCO-Server, a self-hosted application for endpoint management, prior to version 1.2.3, has a flaw that permits users with self-service portal access the ability to queue uninstall jobs without necessary permissions. Specifically, this occurs when the system fails to correctly enforce deployment permissions during the uninstallation process, allowing unauthorized removal of software from computers that the user can view. This shortcoming enables potential abuse by users to manipulate installed software on resources they should not have access to, thus creating a significant security risk for organizations relying on OCO-Server for managing their computing infrastructure. The issue has been rectified in version 1.2.3.

References