Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-114611 (GCVE-0-2026-114611)

Vulnerability from nvd – Published: 2026-10-22 17:33 – Updated: 2026-10-22 17:33

Title

OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/5…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/commit/f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device\u0027s serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device\u0027s freshly minted MDM identity: a certificate with `CN=\u003cserial\u003e` issued by the server\u0027s internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim\u0027s `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device\u0027s MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T17:33:13.611Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df"
        }
      ],
      "source": {
        "advisory": "GHSA-p549-5h7r-7639",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114611",
    "datePublished": "2026-10-22T17:33:13.611Z",
    "dateReserved": "2026-10-21T20:34:25.599Z",
    "dateUpdated": "2026-10-22T17:33:13.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61791 (GCVE-0-2026-61791)

Vulnerability from nvd – Published: 2026-10-22 14:55 – Updated: 2026-10-22 14:55

Title

OCO-Server: Stored XSS through agent hostnames in command buttons

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/e…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator\u0027s authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer-\u003ehostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator\u0027s privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:55:54.269Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-9c2r-9j95-22pr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-9c2r-9j95-22pr"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/ef02f9768e5e1792c3ee53c72e8d7e4ea58ddaa8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/ef02f9768e5e1792c3ee53c72e8d7e4ea58ddaa8"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9c2r-9j95-22pr",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: Stored XSS through agent hostnames in command buttons"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61791",
    "datePublished": "2026-10-22T14:55:54.269Z",
    "dateReserved": "2026-07-10T20:06:05.617Z",
    "dateUpdated": "2026-10-22T14:55:54.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114515 (GCVE-0-2026-114515)

Vulnerability from nvd – Published: 2026-10-22 14:58 – Updated: 2026-10-22 14:58

Title

OCO-Server: Self-Service Portal uninstall-job authorization bypass

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/a…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users\u0027 computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user\u0027s role. This issue is fixed in version 1.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:58:02.272Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/a0b3b6d2c22d01b196c22a9aa0e225429dbf09c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/a0b3b6d2c22d01b196c22a9aa0e225429dbf09c8"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-34mv-3gjp-gf53",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: Self-Service Portal uninstall-job authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114515",
    "datePublished": "2026-10-22T14:58:02.272Z",
    "dateReserved": "2026-10-21T16:15:06.492Z",
    "dateUpdated": "2026-10-22T14:58:02.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114611 (GCVE-0-2026-114611)

Vulnerability from cvelistv5 – Published: 2026-10-22 17:33 – Updated: 2026-10-22 17:33

Title

OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/5…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/commit/f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device\u0027s serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device\u0027s freshly minted MDM identity: a certificate with `CN=\u003cserial\u003e` issued by the server\u0027s internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim\u0027s `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device\u0027s MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T17:33:13.611Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/5cab5ad2461434816d706b7be9cc08bda15c1404"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/f3a6591136f9bd92aff39ddfb26587e6dfdb64df"
        }
      ],
      "source": {
        "advisory": "GHSA-p549-5h7r-7639",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114611",
    "datePublished": "2026-10-22T17:33:13.611Z",
    "dateReserved": "2026-10-21T20:34:25.599Z",
    "dateUpdated": "2026-10-22T17:33:13.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114515 (GCVE-0-2026-114515)

Vulnerability from cvelistv5 – Published: 2026-10-22 14:58 – Updated: 2026-10-22 14:58

Title

OCO-Server: Self-Service Portal uninstall-job authorization bypass

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users' computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/a…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to `self-service/ajax-handler/job-containers.php` pass `uninstall_package_assignment_id[]` values to `lib/SelfService/CoreLogic.class.php::uninstallSelfService()`. Its permission-check loop continues after denied `METHOD_DEPLOY` checks without removing rejected IDs from `$installationIds`, then passes the original list to `lib/CoreLogic.class.php::uninstall()`. The CoreLogic object is constructed with a null SystemUser, causing `lib/CoreLogic.class.php::checkPermission()` to treat the operation as system context and unconditionally permit it. Enumerable `computer_package.id` values allow selection of readable installed-package assignments, including those on other users\u0027 computers. The `deploySelfService()` install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user\u0027s role. This issue is fixed in version 1.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:58:02.272Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-34mv-3gjp-gf53"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/a0b3b6d2c22d01b196c22a9aa0e225429dbf09c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/a0b3b6d2c22d01b196c22a9aa0e225429dbf09c8"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-34mv-3gjp-gf53",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: Self-Service Portal uninstall-job authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114515",
    "datePublished": "2026-10-22T14:58:02.272Z",
    "dateReserved": "2026-10-21T16:15:06.492Z",
    "dateUpdated": "2026-10-22T14:58:02.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61791 (GCVE-0-2026-61791)

Vulnerability from cvelistv5 – Published: 2026-10-22 14:55 – Updated: 2026-10-22 14:55

Title

OCO-Server: Stored XSS through agent hostnames in command buttons

Summary

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/schorschii/OCO-Server/security…	x_refsource_CONFIRM
https://github.com/schorschii/OCO-Server/commit/e…	x_refsource_MISC
https://github.com/schorschii/OCO-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
schorschii	OCO-Server	Affected: < 1.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OCO-Server",
          "vendor": "schorschii",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator\u0027s authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer-\u003ehostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator\u0027s privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:55:54.269Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-9c2r-9j95-22pr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/schorschii/OCO-Server/security/advisories/GHSA-9c2r-9j95-22pr"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/commit/ef02f9768e5e1792c3ee53c72e8d7e4ea58ddaa8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/commit/ef02f9768e5e1792c3ee53c72e8d7e4ea58ddaa8"
        },
        {
          "name": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/schorschii/OCO-Server/releases/tag/v1.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9c2r-9j95-22pr",
        "discovery": "UNKNOWN"
      },
      "title": "OCO-Server: Stored XSS through agent hostnames in command buttons"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61791",
    "datePublished": "2026-10-22T14:55:54.269Z",
    "dateReserved": "2026-07-10T20:06:05.617Z",
    "dateUpdated": "2026-10-22T14:55:54.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for OCO-Server by schorschii

CVE-2026-114611 (GCVE-0-2026-114611)

CVE-2026-61791 (GCVE-0-2026-61791)

CVE-2026-114515 (GCVE-0-2026-114515)

CVE-2026-114611 (GCVE-0-2026-114611)

CVE-2026-114515 (GCVE-0-2026-114515)

CVE-2026-61791 (GCVE-0-2026-61791)