Executive Summary
CVE-2026-61791 is a stored cross-site scripting (XSS) flaw in OCO-Server, a self-hosted endpoint management application used for computer inventory, software deployment and mobile device management. NVD rates it CVSS 7.4 (High). It was published on October 22, 2026.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-61791 |
| CVSS | 7.4 (High) |
| Product | OCO-Server |
| Affected | Versions before 1.2.1 |
| Fixed in | 1.2.1 |
| Class | Stored XSS (script injection into inline event handler) |
| Vulnerable code | Html::commandButton() in lib/Html.class.php |
Html::commandButton() builds an action URL that contains a stored computer hostname and embeds it into a JavaScript string inside an inline onclick attribute. Because the hostname is attacker-influenced data stored by the server, a crafted hostname can break out of the JavaScript string and run script in the browser of any administrator who views the affected page.
Impact
OCO-Server manages software deployment to endpoints, so script running in an administrator's session is a high-value foothold. Depending on the privileges of the viewing user, an attacker could:
- Perform actions in the console as the administrator, including deploying software or commands to managed computers
- Read inventory and device data shown in the console
- Pivot from a single enrolled device to control of the management plane
Registering a device with a malicious hostname is the likely injection path. The NVD description does not state what authentication this requires.
Remediation
- Upgrade OCO-Server to 1.2.1 or later.
- Review the computer inventory for hostnames containing quotes, angle brackets,
javascript:or other unexpected characters, and remove suspicious entries. - Restrict access to the management console to trusted admin networks.
- Deploy a restrictive Content-Security-Policy (no inline script) in front of the console where possible.