{"id":"CVE-2026-121880","aliases":["EUVD-2026-118306","GHSA-45mx-vf84-77ww"],"status":"published","title":"RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","severity":{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00252,"percentile":0.16873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639","CWE-862"],"published":"2026-11-06T15:10:37Z","modified":"2026-11-06T18:35:16Z","products":[{"vendor":"posit software, pbc","product":"posit workbench"},{"vendor":"posit software, pbc","product":"rstudio server"}],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","tags":["release-notes","vendor-advisory"]},{"url":"https://trust.posit.co/updates","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121880"},{"url":"https://github.com/advisories/GHSA-45mx-vf84-77ww"}],"sources":{"cve":[{"id":"CVE-2026-121880","title":"RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","status":"published","published":"2026-11-06T15:10:37.306Z","modified":"2026-11-06T17:45:27.737Z","cvss":[{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2026-118306","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","status":"published","published":"2026-11-06T15:10:37Z","modified":"2026-11-06T17:45:27Z","cvss":[{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-06T21:07:02.228784Z"}],"ghsa":[{"id":"GHSA-45mx-vf84-77ww","title":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in...","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","status":"published","published":"2026-11-06T18:35:11Z","modified":"2026-11-06T18:35:16Z","cvss":[{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-06T19:01:26.771329Z"}],"nvd":[{"id":"CVE-2026-121880","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","status":"published","published":"2026-11-06T16:17:52.943Z","modified":"2026-11-06T20:38:53.57Z","cvss":[{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-06T22:02:17.053381Z"}]}}