CVE-2026-46499
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
Risk Assessment
A read-only user can modify a document within a live session, misleading other participants or causing an authorized editor to unknowingly save changes, compromising document integrity.
Recommendation
Upgrade Collabora Online to version 24.04.18 or 25.04.11. Until then, restrict read-only roles in collaborative sessions and monitor for unusual UNO commands.
Other vulnerabilities in Collabora Online
See all- CVE-2025-66208Critical
Collabora Online - Built-in CODE Server (richdocumentscode) prior to 25.04.702 has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy.
- CVE-2026-48164Medium
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
- CVE-2023-34088High
A stored XSS vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27, allowing an attacker to inject malicious code via document names. When an administrator opened the admin console, the document name could be executed as a script, risking the leak of the JWT.
Original NVD description (English source)
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS