CVE-2026-61791
HighCVSS 7.4Summary
OCO-Server before 1.2.1 has a vulnerability where Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENT_QUOTES) only for HTML escaping. Browsers decode HTML entities before interpreting the handler as JavaScript, so a crafted hostname can escape the string and execute script in an administrator's authenticated session when an affected command button is activated. A remote attacker with the shared agent-registration-key can store an unchecked hostname via oco.agent.hello when agent self-registration is enabled (disabled by default). The issue is fixed in version 1.2.1.
Risk Assessment
An attacker can execute arbitrary script in an administrator's session and abuse their privileges, including deploying software jobs to managed computers. This can lead to compromise of managed endpoints.
Recommendation
Upgrade OCO-Server to version 1.2.1 or later. Until then, keep agent self-registration disabled and protect the shared agent-registration-key.
Other vulnerabilities in OCO-Server
See all- CVE-2026-114515Medium
OCO-Server prior to 1.2.3 allows a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package to queue an uninstall job without deploy permission for those resources. The permission-check loop continues after denied checks without removing rejected IDs, then passes the original list to the uninstall function, which is executed in system context.
- CVE-2026-114611Critical
In OCO-Server prior to 1.2.3, the Apple MDM enrollment endpoint (frontend/api-mdm.php) verifies the signed enrollment-request plist with PKCS7_NOVERIFY, which disables signer certificate chain and trust validation. As a result, an attacker can sign a forged plist with any self-signed certificate, supply a known device's serial number, and via an unauthenticated request obtain the victim's MDM identity (certificate and private key) and overwrite the device record in the database.
Original NVD description (English source)
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS