CVE-2026-23623

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23623", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-14T16:08:37.482Z", "datePublished": "2026-02-05T23:38:02.338Z", "dateUpdated": "2026-02-06T19:28:38.548Z"}, "containers": {"cna": {"title": "Collabora Online vulnerable to Authorization Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2"}], "affected": [{"vendor": "CollaboraOnline", "product": "online", "versions": [{"version": "Collabora Online < 25.04.7.5", "status": "affected"}, {"version": "Collabora Online < 24.04.17.3", "status": "affected"}, {"version": "Collabora Online < 23.05.20.1", "status": "affected"}, {"version": "Collabora Online Development Edition < 25.04.08.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-05T23:38:02.338Z"}, "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5."}], "source": {"advisory": "GHSA-68v6-r6qq-mmq2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T19:28:30.743631Z", "id": "CVE-2026-23623", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T19:28:38.548Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Collabora Online vulnerable to Authorization Bypass", "source": {"advisory": "GHSA-68v6-r6qq-mmq2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "CollaboraOnline", "product": "online", "versions": [{"status": "affected", "version": "Collabora Online < 25.04.7.5"}, {"status": "affected", "version": "Collabora Online < 24.04.17.3"}, {"status": "affected", "version": "Collabora Online < 23.05.20.1"}, {"status": "affected", "version": "Collabora Online Development Edition < 25.04.08.2"}]}], "references": [{"url": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2", "name": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-05T23:38:02.338Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23623", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T19:28:30.743631Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-06T19:28:35.393Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-23623", "state": "PUBLISHED", "dateUpdated": "2026-02-05T23:38:02.338Z", "dateReserved": "2026-01-14T16:08:37.482Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-05T23:38:02.338Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "online", "vendor": "CollaboraOnline", "versions": [{"status": "affected", "version": "Collabora Online < 25.04.7.5"}, {"status": "affected", "version": "Collabora Online < 24.04.17.3"}, {"status": "affected", "version": "Collabora Online < 23.05.20.1"}, {"status": "affected", "version": "Collabora Online Development Edition < 25.04.08.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5."}, {"lang": "es", "value": "Collabora Online es una suite ofim\u00e1tica colaborativa en l\u00ednea basada en la tecnolog\u00eda de LibreOffice. Antes de la versi\u00f3n 25.04.08.2 de Collabora Online Development Edition y antes de las versiones 23.05.20.1, 24.04.17.3 y 25.04.7.5 de Collabora Online, un usuario con derechos de solo lectura y sin privilegios de descarga puede obtener una copia local de un archivo compartido. Aunque no hay botones correspondientes en la interfaz, al presionar Ctrl+Shift+S se inicia el proceso de descarga del archivo. Esto permite al usuario eludir las restricciones de acceso y conduce a la recuperaci\u00f3n de datos no autorizada. Este problema ha sido parcheado en la versi\u00f3n 25.04.08.2 de Collabora Online Development Edition y en las versiones 23.05.20.1, 24.04.17.3 y 25.04.7.5 de Collabora Online."}], "id": "CVE-2026-23623", "lastModified": "2026-06-17T10:21:51.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23623", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T19:28:30.743631Z", "version": "2.0.3"}}]}, "published": "2026-02-06T00:15:56.663", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:57:56.456050+00:00", "value": {"mitigation_remediation": ["Upgrade Collabora Online to Development Edition version 25.04.08.2 or later, or to stable releases 23.05.20.1, 24.04.17.3, or 25.04.7.5 or newer.", "Ensure that all servers and containers running Collabora Online have been updated to one of these secure releases and that no legacy copies remain accessible.", "If an immediate upgrade is not possible, reduce the exposure of view\u2011only users by restricting or disabling shared document access for those roles and by applying network controls to limit outbound access from clients belonging to that user group."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized data retrieval via hidden keyboard shortcut"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Collabora Online Development Edition versions older than 25.04.08.2 and stable Collabora Online releases older than 23.05.20.1, 24.04.17.3, and 25.04.7.5. Administrators should inventory any Collabora Online deployments and compare them against these baseline versions to determine exposure.", "description_and_impact": "Collabora Online, a collaborative office suite built on LibreOffice technology, allows a user with view\u2011only permissions to obtain a full copy of a shared document through a concealed keyboard shortcut, Ctrl+Shift+S. This shortcut triggers the download routine even though the interface displays no download button, thereby bypassing the intended download restrictions. The flaw represents an authorization bypass weakness (CWE\u2011285) that can lead to unauthorized data retrieval.", "risk_and_exploitability": "The CVSS score of 5.3 denotes moderate severity, and the EPSS value of less than 1\u202f% indicates a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Because the exploit requires a user with view\u2011only rights to press the shortcut within the application, the attack vector is inferred to be local or user\u2011initiated. Overall risk is moderate with limited impact if the environment limits view\u2011only users or restricts external access."}}}}, "created": "2026-02-06T12:05:02.089867+00:00", "updated": "2026-04-17T23:00:12.652200+00:00", "vendors": ["collaboraoffice", "collaboraoffice$PRODUCT$online"]}