Collabora Online EUVD-2026-114090

The attacker must already hold a valid read-only session in a live document - specifically a viewer-role WOPI user - so a working Collabora Online integration and an issued read-only session are prerequisites (reflected in PR:L). Exploitation uses crafted WebSocket messages to invoke document-mutating UNO commands and dialog operations on affected server paths that failed to enforce the session's read-only state; no end-user interaction by a victim is required to perform the mutation (UI:N). Impact is sharply limited: the read-only attacker cannot save the document, changes exist only in the per-document kit process and are discarded when the session ends, so durable effect requires an authorized editor to be sharing the same live session and to save the changes, and the only other effect is misleading concurrent co-viewers. Affected: Collabora Online < 24.04.18 and < 25.04.11.

This is a genuinely low-to-moderate risk issue, consistent with its 4.3 CVSS, and the multiple signals agree rather than conflict. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) correctly captures a network-reachable but privilege-requiring (PR:L - the attacker must already hold a valid read-only/viewer session) authorization flaw with only partial integrity impact and no confidentiality or availability impact. The SSVC/priority Decision label is 'this_month', not act_now or emergency, which aligns with the limited impact. There is no CISA KEV listing (not confirmed actively exploited), no EPSS score was supplied, and no public exploit code or PoC reference is present in the input beyond the vendor's own GHSA advisory - so exploitation is theoretical at this point. The real-world damage ceiling is explicitly bounded by the vendor: a read-only attacker cannot save the document, changes live only in the per-document kit process and are discarded when the session ends, so harm requires either deceiving concurrent co-viewers or tricking an authorized editor in the same live session into saving attacker-introduced changes. This is a real but narrow authorization defect, not a high-severity priority.

A user granted only viewer (read-only) WOPI access joins a live document session, toggles the read-only client UI into edit mode (the UI is not a security control), and sends crafted WebSocket messages that invoke document-mutating UNO commands and dialog operations the server failed to block. Co-viewers in the session see the injected modifications, and if an authorized editor is sharing the session they may save the attacker's changes without realizing they were introduced. No public exploit code is identified at time of analysis; exploitation requires an existing low-privilege read-only session.