CVE-2026-23623: fallo de gravedad media en CollaboraOnline online
Collabora Online vulnerable to Authorization Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.2%
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
CollaboraOnline · onlineCVEs relacionadas — CollaboraOnline online
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-66208HIGHConfiguration-Dependent RCE (OS Command Injection) in richdocumentscode proxyEPSS 1.8%CVE-2021-32744CRITICALUnauthenticated attacker could gain access to currently open filesEPSS 1.1%CVE-2021-43817HIGHReflected Cross-Site-Scripting vulnerability in Collabora OnlineEPSS 0.7%CVE-2021-32745HIGHReflected Cross-Site-Scripting vulnerabilityEPSS 0.6%CVE-2025-24796MEDIUMRemote Code Execution within Collabora Online jail with Macros EnabledEPSS 0.5%CVE-2023-49788HIGHImproper handling of browser-side provided input in richdocuments path handlingEPSS 0.5%