Collabora Online: Read-only session authorization bypass permits live document edits

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…online/security/advisories/GHSA-27j2-3cqv-cc5q Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:00Yayımlandı

İlgili açıklar

• 4,7 CVE-2026-48164Collabora Online: Reflected HTML injection through host_session_id
• 8,3 CVE-2026-115642In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in p…
• 6,1 CVE-2026-61789DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
• 7,1 CVE-2026-119649Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
• 4,4 CVE-2026-119573Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
• 5,1 CVE-2025-68392Incorrect authorization in Protectel