CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

Authorization bypass through user-controlled key in the localhost port-proxy /p// in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...

CVE-2026-121880: Posit Software, PBC: Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC…

Authorization bypass through user-controlled key in the localhost port-proxy /p/ / in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to...