Authorization Bypass in RStudio Server and Posit Workbench by Posit Software

CVE-2026-121880

What is CVE-2026-121880?

An authorization bypass vulnerability has been identified in RStudio Server and Posit Workbench, which allows remote authenticated users to gain unauthorized access to web applications and services bound to 127.0.0.1. This is achieved through a user-controlled port-proxy that does not verify the legitimacy of the requesting user's session. The risk is exacerbated in environments where multiple users and privileged localhost services co-exist. Exploitation requires an authenticated account on the server, making it critical for administrators to review their security settings, particularly regarding the proxy configurations.

References