A valid Self‑Service Portal user who can create job containers and has read visibility on a computer and package can queue an uninstall job for those resources without ever having deploy permission. The application’s permission‑check loop continues after a denied deploy check, passes the original list to a core uninstall routine, and the core logic interprets the operation as a system context because the SystemUser is null. This permits the user to trigger the removal of software across any resources that are visible to their role, effectively bypassing authorization controls and enabling arbitrary deletion of installed packages. The vulnerability is resolved in version 1.2.3.

OCO‑Server, a self‑hosted endpoint management application, is affected in all releases prior to 1.2.3. Users who rely on the Self‑Service Portal for software deployment and inventory are at risk if they have job‑container creation permissions and can view other users’ computers and packages.

The CVSS score of 6.5 indicates a moderate severity, but the vulnerability enables privilege escalation by allowing a non‑privileged user to execute uninstall actions that they should not be able to perform. No exploit code is publicly available, and the EPSS score is not published. The vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access to the Self‑Service Portal and sufficient read visibility on the target resources. Once those prerequisites are satisfied, the exploit path is straightforward: submit a job‑creation request with the uninstall_package_assignment_id[] values and the application will perform the removal under system context. This provides a high damage potential if an attacker can gain access to the portal.