OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to "self-service/ajax-handler/job-containers.php" pass "uninstall_package_assignment_id[]" values to "lib/SelfService/CoreLogic.class.php::uninstallSelfService()". Its permission-check loop continues after denied "METHOD_DEPLOY" checks without removing rejected IDs from "$installationIds", then passes the original list to "lib/CoreLogic.class.php::uninstall()". The CoreLogic object is constructed with a null SystemUser, causing "lib/CoreLogic.class.php::checkPermission()" to treat the operation as system context and unconditionally permit it. Enumerable "computer_package.id" values allow selection of readable installed-package assignments, including those on other users' computers. The "deploySelfService()" install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.