CVE-2026-114515 OCO-Server: Self-Service Portal uninstall-job authorization bypass

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job...

CVE-2026-114515

Prior to version 1.2.3 , OCO-Server (an endpoint management application) is vulnerable to an authorization bypass that allows a Self-Service Portal user to queue unauthorized software-removal jobs. The root cause is located in lib/SelfService/CoreLogic.class.php::uninstallSelfService(), where a p...