{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121880","assignerOrgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","state":"PUBLISHED","assignerShortName":"POSIT","dateReserved":"2026-11-04T10:49:21.246Z","datePublished":"2026-11-06T15:10:37.306Z","dateUpdated":"2026-11-06T17:45:27.737Z"},"containers":{"cna":{"providerMetadata":{"orgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","shortName":"POSIT","dateUpdated":"2026-11-06T15:12:38.657Z"},"title":"RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership","datePublic":"2026-11-04T11:03:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","type":"CWE"}]},{"descriptions":[{"lang":"en","cweId":"CWE-862","description":"CWE-862 Missing Authorization","type":"CWE"}]}],"impacts":[{"descriptions":[{"lang":"en","value":"Information disclosure: an authenticated user can view another user's running application and the data it renders. Where other network services are bound to localhost on the same host, those services may also become reachable through the proxy, and the potential impact in those deployments depends on what is running and how it is configured."}]}],"affected":[{"vendor":"Posit Software, PBC","product":"Posit Workbench","platforms":["Linux"],"collectionURL":"https://posit.co/download/rstudio-server-pro/","modules":["localhost port-proxy (/p/<token>/)"],"programFiles":["src/cpp/core/http/UrlPorts.cpp"],"versions":[{"status":"affected","version":"0","lessThan":"2026.08.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:*"]},{"vendor":"Posit Software, PBC","product":"RStudio Server","platforms":["Linux"],"collectionURL":"https://posit.co/download/rstudio-server/","modules":["localhost port-proxy (/p/<token>/)"],"programFiles":["src/cpp/core/http/UrlPorts.cpp"],"versions":[{"status":"affected","version":"0","lessThan":"2026.08.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Authorization bypass through user-controlled key in the localhost port-proxy (<code>/p/&lt;token&gt;/</code>) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.</p><p>NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by <code>allow-shell=false</code>; no setting restricts the port-proxy without disabling all application proxying.</p>"}]}],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","name":"RStudio IDE / RStudio Server release notes","tags":["release-notes","vendor-advisory"]},{"url":"https://trust.posit.co/updates","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":4.7,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber"}}],"configurations":[{"lang":"en","value":"Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default).&nbsp;</p>"}]}],"workarounds":[{"lang":"en","value":"Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session.</p>"}]}],"timeline":[{"time":"2026-05-22T00:00:00.000Z","lang":"en","value":"Reported to Posit through coordinated disclosure"},{"time":"2026-05-22T00:00:00.000Z","lang":"en","value":"Reproduced internally with a working proof of concept against Posit Workbench 2025.09"},{"time":"2026-07-22T00:00:00.000Z","lang":"en","value":"CVE submission and security advisory approved by Posit"}],"credits":[{"lang":"en","value":"Luiz Felipe Mol (confu53)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-06T17:21:05.517519Z","id":"CVE-2026-121880","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-06T17:45:27.737Z"}}]}}