schorschii OCO-Server up to 1.2.2 Permission Check CoreLogic.class.php uninstallSelfService uninstall_package_assignment_id privileges management

Summaryinfo

A vulnerability identified as problematic has been detected in schorschii OCO-Server up to 1.2.2. Affected by this vulnerability is the function lib/SelfService/CoreLogic.class.php::uninstallSelfService of the file lib/SelfService/CoreLogic.class.php of the component Permission Check. The manipulation of the argument uninstall_package_assignment_id leads to privileges management. This vulnerability is referenced as CVE-2026-114515. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in schorschii OCO-Server up to 1.2.2. This issue affects the function lib/SelfService/CoreLogic.class.php::uninstallSelfService of the file lib/SelfService/CoreLogic.class.php of the component Permission Check. The manipulation of the argument uninstall_package_assignment_id with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity. The summary by CVE is:

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-114515 since 10/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

By approaching the search of inurl:lib/SelfService/CoreLogic.class.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• schorschii

Name

• OCO-Server

Version

• 1.2.0
• 1.2.1
• 1.2.2

Website

• Product: https://github.com/schorschii/OCO-Server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion