{"id":"CVE-2026-121880","published":"2026-11-06T16:17:52.943","lastModified":"2026-11-06T20:38:53.570","description":"Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-639","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","tags":[]},{"url":"https://trust.posit.co/updates","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}