{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114611 exists.","fix":"No fix has been published for CVE-2026-114611 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server, published on 22 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-114611 and fix it if it is affected.\n\nWhat it is: CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server, published on 22 Oct 2026. \nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114611 exists.\n\nAffected product: schorschii OCO-Server. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-114611/ (Markdown: https://insights.sbomify.com/CVE-2026-114611/index.md)","id":"CVE-2026-114611","markdown":"https://insights.sbomify.com/CVE-2026-114611/index.md","name":"CVE-2026-114611","record":{"aliases":["GHSA-p549-5h7r-7639"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=\u003cserial\u003e` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.","id":"CVE-2026-114611","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","id":"CVE-2026-114612"},"packages":[],"prev":{"headline":"fpdf2: Exponential SVG '\u003cuse\u003e' expansion causes CPU and memory exhaustion in 'FPDF.image()'","id":"CVE-2026-114610"},"products":["OCO-Server"],"published":"2026-10-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-29","vendors":["schorschii"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-114611/"}