{"id":"CVE-2026-90631","kind":"vulnerability","aliases":["CVE-2026-90631"],"related":[],"title":"OpenOffice: crafted documents load external links without prompting","description":"Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links \nto be loaded without prompt, possibly transferring the contents of environment variables in the process.\n\n\n\nThis issue affects Apache OpenOffice: through 4.1.16.\n\n\n\nUsers are recommended to upgrade to version 4.1.17, which fixes the issue.","summary":"A crafted Apache OpenOffice document can make the program load external links without asking the user first. The load can carry environment variable contents to the linked location.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package"],"not_affected_if":["no-untrusted-documents","version-4.1.17-or-later"],"how_to_check":"- Check the installed OpenOffice version; affected releases are `4.1.16` and earlier.\n- Look for OpenOffice installs on desktops and shared machines that open documents from outside sources.","fix":"- Upgrade Apache OpenOffice to `4.1.17`.","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:38+00:00","updated_at":"2026-11-04T11:27:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OpenOffice to `4.1.17`.","reach":"local","title":"OpenOffice: crafted documents load external links without prompting","impact":"low","summary":"A crafted Apache OpenOffice document can make the program load external links without asking the user first. The load can carry environment variable contents to the linked location.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"external links load silently, leaking environment variable contents","analyst_note":"","how_to_check":"- Check the installed OpenOffice version; affected releases are `4.1.16` and earlier.\n- Look for OpenOffice installs on desktops and shared machines that open documents from outside sources.","plain_action":"Update Apache OpenOffice to version 4.1.17 or newer.","needs_analyst":false,"not_affected_if":["version-4.1.17-or-later","no-untrusted-documents"],"who_is_affected":"Anyone running Apache OpenOffice 4.1.16 or earlier who opens documents from untrusted sources. The sources do not say whether server-side or automated document conversion is affected. Teams that only use newer releases or do not open outside documents can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":4134,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-90631':11A,14A '4.1.16':92C '4.1.17':100C 'affect':88C 'allow':59C 'apach':20B,46C,57C,89C 'ask':31B 'attack':61C 'author':54C 'carri':38B 'caus':68C 'contain':50C 'content':41B,79C 'craft':2A,19B,63C 'cve':9A,12A 'desktop':15B 'document':3A,22B,48C,65C 'environ':39B,81C 'extern':5A,28B,69C 'first':34B 'fix':102C 'issu':87C,104C 'link':6A,29B,44B,51C,70C 'load':4A,27B,36B,73C 'locat':45B 'make':24B 'miss':53C 'openoffic':1A,16B,21B,47C,58C,90C 'packag':17B 'possibl':76C 'process':85C 'program':26B 'prompt':8A,75C 'recommend':95C 'transfer':77C 'upgrad':97C 'user':33B,93C 'variabl':40B,82C 'version':99C 'vulner':55C 'without':7A,30B,74C 'would':67C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Apache OpenOffice 4.1.16 or earlier who opens documents from untrusted sources. The sources do not say whether server-side or automated document conversion is affected. Teams that only use newer releases or do not open outside documents can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 or newer.","pkeys":[],"ptokens":[],"labels":["desktop","medium","openoffice","package"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90631","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}