CVE-2026-121880

Authorization bypass through user-controlled key in the localhost port-proxy /p// in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...

CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

Authorization bypass through user-controlled key in the localhost port-proxy /p// in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...

CVE-2026-121880

Posit Software , PBC RStudio Server , and Posit Workbench versions prior to 2026.08.0 are vulnerable to an authorization bypass in the localhost port-proxy. The root cause is that the proxy fails to enforce per-session port ownership; it allows a remote authenticated user to use their own port to...

EUVD-2026-118306

Authorization bypass through user-controlled key in the localhost port-proxy /p// in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...

CVE-2026-121880: Posit Software, PBC: Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC…

Authorization bypass through user-controlled key in the localhost port-proxy /p/ / in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...