Live › vulnerability › CVE-2026-46499
Collabora Online, a browser-based office suite built on LibreOffice, fails to enforce read-only mode for some document operations. A read-only user, such as a WOPI viewer, can send crafted WebSocket messages to change the document as seen by others in the session, and an editor may unknowingly save those changes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams that run Collabora Online, typically self-hosted behind a WOPI host such as Nextcloud or ownCloud, are exposed before the fixed versions. Exposure needs a read-only (viewer) session in a shared document; deployments without read-only WOPI users have less reason to worry. Hosted Collabora services are handled by their provider.
No product ranges from the sources yet.
24.04.x or 25.04.x branches) against the fixed versions below.24.04 branch: 24.04.1825.04 branch: 25.04.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-46499")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.