EUVD-2026-31838
GHSA-fg53-m88f-73jq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. This allows authenticated users with low-level permissions (User or Guest) to retrieve sensitive information, such as the Owner's unique identifier (ID) and profile information, which should only be accessible to administrators.
AnalysisAI
IDOR vulnerability across multiple REST API endpoints in ONLYOFFICE DocSpace before 3.2.1 allows authenticated low-privilege users (User or Guest roles) to exfiltrate owner account identifiers and profile data that should be restricted to administrators. The flaw stems from missing object-level authorization checks on API responses, meaning the server returns sensitive records without validating whether the requester holds sufficient privilege to view them. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this in the 1st percentile for exploitation probability.
Technical ContextAI
ONLYOFFICE DocSpace is a collaborative document management platform exposing a REST API for user and workspace management operations. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: API endpoints accept object references (such as user or owner identifiers) supplied or inferred by the client, but fail to enforce server-side checks confirming the requester's role is permitted to retrieve the referenced object's data. Because the authorization gap exists across multiple endpoints rather than a single route, the attack surface is broader than a typical single-endpoint IDOR. The CVSS vector AV:N/AC:L/PR:L/UI:N reflects that exploitation is network-accessible, low-complexity, and requires only a low-privilege authenticated session, but scope is unchanged and impact is limited to confidentiality.
RemediationAI
Upgrade ONLYOFFICE DocSpace to version 3.2.1 or later, which is confirmed to address this vulnerability per the security section of the official CHANGELOG at https://github.com/ONLYOFFICE/DocSpace/blob/master/CHANGELOG.md#security. For organizations unable to upgrade immediately, a targeted compensating control is to restrict access to the affected REST API endpoints at the reverse proxy or API gateway layer, blocking User and Guest roles from reaching endpoints that return owner profile data - note this may break legitimate product functionality and should be tested before deployment. Additionally, auditing API access logs for anomalous cross-user object reference patterns can help detect exploitation attempts in the interim. No workaround eliminates the root cause; patching to 3.2.1 is the authoritative remediation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today