{"api_version":"1","generated_at":"2026-11-06T18:31:11+00:00","cve":"CVE-2026-121880","urls":{"html":"https://cve.report/CVE-2026-121880","api":"https://cve.report/api/cve/CVE-2026-121880.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-121880","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-121880"},"summary":{"title":"RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","state":"PUBLISHED","assigner":"POSIT","published_at":"2026-11-06 16:17:52","updated_at":"2026-11-06 18:18:00"},"problem_types":["CWE-639","CWE-862","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"4.0","source":"8c484e69-127d-402b-9cdb-5f86ef43eb86","type":"Secondary","score":"4.7","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"4.7","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","data":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":4.7,"baseSeverity":"MEDIUM","exploitMaturity":"PROOF_OF_CONCEPT","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"}}],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","name":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","refsource":"8c484e69-127d-402b-9cdb-5f86ef43eb86","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://trust.posit.co/updates","name":"https://trust.posit.co/updates","refsource":"8c484e69-127d-402b-9cdb-5f86ef43eb86","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121880","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121880","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Posit Software, PBC","product":"Posit Workbench","version":"affected 2026.08.0 custom","platforms":["Linux"]},{"source":"CNA","vendor":"Posit Software, PBC","product":"RStudio Server","version":"affected 2026.08.0 custom","platforms":["Linux"]}],"timeline":[{"source":"CNA","time":"2026-05-22T00:00:00.000Z","lang":"en","value":"Reported to Posit through coordinated disclosure"},{"source":"CNA","time":"2026-05-22T00:00:00.000Z","lang":"en","value":"Reproduced internally with a working proof of concept against Posit Workbench 2025.09"},{"source":"CNA","time":"2026-07-22T00:00:00.000Z","lang":"en","value":"CVE submission and security advisory approved by Posit"}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Luiz Felipe Mol (confu53)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-121880","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:21:05.517519Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-06T17:45:27.737Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://posit.co/download/rstudio-server-pro/","cpes":["cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["localhost port-proxy (/p/<token>/)"],"platforms":["Linux"],"product":"Posit Workbench","programFiles":["src/cpp/core/http/UrlPorts.cpp"],"vendor":"Posit Software, PBC","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"}]},{"collectionURL":"https://posit.co/download/rstudio-server/","cpes":["cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["localhost port-proxy (/p/<token>/)"],"platforms":["Linux"],"product":"RStudio Server","programFiles":["src/cpp/core/http/UrlPorts.cpp"],"vendor":"Posit Software, PBC","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default).&nbsp;</p>"}],"value":"Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default)."}],"credits":[{"lang":"en","type":"finder","value":"Luiz Felipe Mol (confu53)"}],"datePublic":"2026-11-04T11:03:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Authorization bypass through user-controlled key in the localhost port-proxy (<code>/p/&lt;token&gt;/</code>) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.</p><p>NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by <code>allow-shell=false</code>; no setting restricts the port-proxy without disabling all application proxying.</p>"}],"value":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying."}],"impacts":[{"descriptions":[{"lang":"en","value":"Information disclosure: an authenticated user can view another user's running application and the data it renders. Where other network services are bound to localhost on the same host, those services may also become reachable through the proxy, and the potential impact in those deployments depends on what is running and how it is configured."}]}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":4.7,"baseSeverity":"MEDIUM","exploitMaturity":"PROOF_OF_CONCEPT","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-06T15:12:38.657Z","orgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","shortName":"POSIT"},"references":[{"name":"RStudio IDE / RStudio Server release notes","tags":["release-notes","vendor-advisory"],"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0"},{"tags":["vendor-advisory"],"url":"https://trust.posit.co/updates"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session.</p>"}],"value":"Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-05-22T00:00:00.000Z","value":"Reported to Posit through coordinated disclosure"},{"lang":"en","time":"2026-05-22T00:00:00.000Z","value":"Reproduced internally with a working proof of concept against Posit Workbench 2025.09"},{"lang":"en","time":"2026-07-22T00:00:00.000Z","value":"CVE submission and security advisory approved by Posit"}],"title":"RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.</p>"}],"value":"Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","assignerShortName":"POSIT","cveId":"CVE-2026-121880","datePublished":"2026-11-06T15:10:37.306Z","dateReserved":"2026-11-04T10:49:21.246Z","dateUpdated":"2026-11-06T17:45:27.737Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-06 16:17:52","lastModifiedDate":"2026-11-06 18:18:00","problem_types":["CWE-639","CWE-862","CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV40":[{"source":"8c484e69-127d-402b-9cdb-5f86ef43eb86","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-06T17:21:05.517519Z","id":"CVE-2026-121880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"121880","Ordinal":"1","Title":"RStudio Server / Posit Workbench localhost port-proxy does not e","CVE":"CVE-2026-121880","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"121880","Ordinal":"1","NoteData":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","Type":"Description","Title":"RStudio Server / Posit Workbench localhost port-proxy does not e"}]}}}