{"id":"CVE-2026-46499","kind":"vulnerability","aliases":["CVE-2026-46499"],"related":[],"title":"Collabora Online: read-only users can alter open documents via crafted messages","description":"Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.","summary":"Collabora Online, a browser-based office suite built on LibreOffice, fails to enforce read-only mode for some document operations. A read-only user, such as a WOPI viewer, can send crafted WebSocket messages to change the document as seen by others in the session, and an editor may unknowingly save those changes.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["collabora-online","nextcloud","package","self-hosted","wopi"],"not_affected_if":["managed-hosting","no-viewer-role-users"],"how_to_check":"- Check the installed Collabora Online version (`24.04.x` or `25.04.x` branches) against the fixed versions below.\n- Look for viewer-role WOPI users who can open documents that editors also work on.","fix":"- Collabora Online `24.04` branch: `24.04.18`\n- Collabora Online `25.04` branch: `25.04.11`","status":"open","published_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:34:00+00:00","updated_at":"2026-10-30T15:34:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:34:00Z","model":"claude-haiku-5-5","output":{"fix":"- Collabora Online `24.04` branch: `24.04.18`\n- Collabora Online `25.04` branch: `25.04.11`","reach":"network","title":"Collabora Online: read-only users can alter open documents via crafted messages","impact":"medium","summary":"Collabora Online, a browser-based office suite built on LibreOffice, fails to enforce read-only mode for some document operations. A read-only user, such as a WOPI viewer, can send crafted WebSocket messages to change the document as seen by others in the session, and an editor may unknowingly save those changes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["collabora-online","self-hosted","wopi","nextcloud"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"read-only user alters shared document content seen by co-viewers","analyst_note":"","how_to_check":"- Check the installed Collabora Online version (`24.04.x` or `25.04.x` branches) against the fixed versions below.\n- Look for viewer-role WOPI users who can open documents that editors also work on.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-viewer-role-users"],"who_is_affected":"Teams that run Collabora Online, typically self-hosted behind a WOPI host such as Nextcloud or ownCloud, are exposed before the fixed versions. Exposure needs a read-only (viewer) session in a shared document; deployments without read-only WOPI users have less reason to worry. Hosted Collabora services are handled by their provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4273,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-46499':16A,19A '24.04.18':99C,213C '25.04.11':101C,215C 'alter':8A 'attack':186C 'author':172C,203C 'base':34B,93C 'browser':33B 'browser-bas':32B 'built':37B 'cannot':187C 'chang':67B,84B,160C,193C 'co':164C 'co-view':163C 'collabor':89C 'collabora':1A,21B,29B,85C 'collabora-onlin':20B 'command':149C 'craft':12A,63B,140C 'cve':14A,17A 'deleg':105C 'despit':153C 'dialog':151C 'direct':191C 'discard':195C 'document':10A,49B,69B,103C,112C,146C,190C 'document-mut':145C 'editor':79B,173C,204C 'end':200C 'enforc':42B,117C 'execut':144C 'fail':40B,115C 'fix':210C 'host':27B 'interfac':158C 'issu':208C 'kit':113C,198C 'libreoffic':39B,95C 'libreofficekit':107C 'live':168C 'may':80B 'messag':13A,65B,142C 'mislead':162C 'mode':46B 'modif':181C 'mutat':147C 'nextcloud':23B 'offic':35B,91C 'onlin':2A,22B,30B,86C,90C 'open':9A 'oper':50B,104C,152C 'other':73B 'packag':24B 'per':111C 'per-docu':110C 'prior':97C 'process':114C 'read':4A,44B,53B,122C,127C,156C,184C 'read-on':3A,43B,52B,121C,126C,155C,183C 'role':135C 'save':82B,179C,188C,205C 'seen':71B 'self':26B 'self-host':25B 'send':62B,139C 'session':76B,119C,169C,176C,199C 'sever':102C 'share':174C 'state':124C 'suit':36B,92C 'technolog':96C 'unknow':81B,178C 'unless':201C 'uno':148C 'user':6A,55B,129C,137C 'version':212C 'via':11A 'viewer':60B,134C,165C 'viewer-rol':133C 'websocket':64B,141C 'within':166C 'wopi':28B,59B,136C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Collabora Online, typically self-hosted behind a WOPI host such as Nextcloud or ownCloud, are exposed before the fixed versions. Exposure needs a read-only (viewer) session in a shared document; deployments without read-only WOPI users have less reason to worry. Hosted Collabora services are handled by their provider.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46499","severity":null,"published_at":"2026-10-30T15:16:52+00:00","modified_at":"2026-10-30T15:16:52+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}