An authorization bypass exists in Posit Server’s localhost port‑proxy, where a user‑controlled key encoded in the proxy URL is not validated against the owning session. This flaw allows any authenticated user on a shared multi‑user instance to request port numbers that belong to other users, enabling them to reach web applications and other services bound to 127.0.0.1, view live rendered content and data. The vulnerability is a classic missing authorization error (CWE‑639, CWE‑862).

Affected products are Posit Software’s RStudio Server and Posit Workbench. Users of versions prior to 2026.08.0 are susceptible, as the flaw was not patched in those releases.

The CVSS score is 4.7, indicating moderate severity. Exploitation requires an authenticated session on the same multi‑user server and that the target service is listening on localhost at the time of access. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Although no configuration setting can disable the port‑proxy without also disabling all application proxying, the most effective mitigation is to apply the vendor’s patch. In the meantime the risk may be exacerbated on hosts that co‑locate privileged localhost services, as the bypass is not prevented by the allow‑shell setting.