OCO-Server CVE-2026-114515

Requires (1) the Self-Service Portal feature to be enabled/configured on OCO-Server (documented in Self-Service.md), (2) a valid Self-Service Portal account whose role grants permission to create job containers AND 'read' visibility on the target computer and package, and (3) OCO-Server at a version prior to 1.2.3. No 'deploy' permission on the target resources is needed - that is precisely the control that fails open. Limiting factors that reduce real-world risk: the attacker must hold an authenticated low-privilege portal account (not anonymous/unauthenticated), and must have at least 'read' visibility on the targeted computer/package because getMyComputer()/getMyPackage() still throw without read rights; targets are selected via trivially enumerable sequential computer_package.id integers. Only the uninstall path is affected - the install (deploySelfService) path fails closed and is not exploitable.

This is a genuine but moderate-priority issue, best characterized as an authenticated authorization bypass rather than a high-urgency internet-facing threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5 Medium) is internally consistent with the mechanism: network-reachable, low attacker complexity, but requiring a valid low-privilege Self-Service Portal account (PR:L) and no confidentiality impact (C:N), with the severity driven entirely by high integrity impact (I:H) from unauthorized software removal. No EPSS score and no CISA KEV entry were supplied in the input, so widespread or automated exploitation cannot be inferred; the vuln.today decision label is 'this_month', which signals a scheduled-remediation rather than an emergency/act_now posture. Against that, the vendor GHSA advisory includes a fully reproducible, independently DB-verified proof-of-concept (Docker + MariaDB, real schema, seed scripts, attack transcript), which raises practical exploitability for anyone who already holds a portal account. Net: real and fixable, with confirmed working PoC and clear integrity impact, but gated behind authenticated low-privilege access to a niche product - prioritize patching within a normal cycle, not as a fire drill. Missing signals (EPSS, KEV, SSVC automatable/technical-impact fields) should be noted rather than assumed benign.

A low-privilege Self-Service Portal user - holding only 'read' visibility on a shared software catalog plus job-container create rights, but no 'deploy' permission - enumerates the small sequential computer_package.id values and submits a crafted uninstall request to self-service/ajax-handler/job-containers.php. Because the uninstall path fails open (rejected IDs are not removed from the list and the downstream CoreLogic is constructed with a null SystemUser that short-circuits all permission checks), the server queues software-removal jobs on other users' or departments' computers. A detailed, reproducible PoC (full Docker reproduction with DB verification) is published in the vendor GHSA advisory; given AV:N and AC:L, exploitation is a straightforward HTTP request once the attacker has any valid portal account.