What is the CVSS score of EUVD-2026-31838?

EUVD-2026-31838 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

ONLYOFFICE DocSpace EUVD-2026-31838

| CVE-2026-38587 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-26 mitre

GHSA-fg53-m88f-73jq

Authentication Bypass N A

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:23 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

4.3 (MEDIUM)

CVE Published

May 26, 2026 - 00:00 nvd

MEDIUM 4.3

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. This allows authenticated users with low-level permissions (User or Guest) to retrieve sensitive information, such as the Owner's unique identifier (ID) and profile information, which should only be accessible to administrators.

AnalysisAI

IDOR vulnerability across multiple REST API endpoints in ONLYOFFICE DocSpace before 3.2.1 allows authenticated low-privilege users (User or Guest roles) to exfiltrate owner account identifiers and profile data that should be restricted to administrators. The flaw stems from missing object-level authorization checks on API responses, meaning the server returns sensitive records without validating whether the requester holds sufficient privilege to view them. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this in the 1st percentile for exploitation probability.

Technical ContextAI

ONLYOFFICE DocSpace is a collaborative document management platform exposing a REST API for user and workspace management operations. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: API endpoints accept object references (such as user or owner identifiers) supplied or inferred by the client, but fail to enforce server-side checks confirming the requester's role is permitted to retrieve the referenced object's data. Because the authorization gap exists across multiple endpoints rather than a single route, the attack surface is broader than a typical single-endpoint IDOR. The CVSS vector AV:N/AC:L/PR:L/UI:N reflects that exploitation is network-accessible, low-complexity, and requires only a low-privilege authenticated session, but scope is unchanged and impact is limited to confidentiality.

RemediationAI

Upgrade ONLYOFFICE DocSpace to version 3.2.1 or later, which is confirmed to address this vulnerability per the security section of the official CHANGELOG at https://github.com/ONLYOFFICE/DocSpace/blob/master/CHANGELOG.md#security. For organizations unable to upgrade immediately, a targeted compensating control is to restrict access to the affected REST API endpoints at the reverse proxy or API gateway layer, blocking User and Guest roles from reaching endpoints that return owner profile data - note this may break legitimate product functionality and should be tested before deployment. Additionally, auditing API access logs for anomalous cross-user object reference patterns can help detect exploitation attempts in the interim. No workaround eliminates the root cause; patching to 3.2.1 is the authoritative remediation.