Online
Monthly
Read-only session enforcement bypass in Collabora Online before 24.04.18 and 25.04.11 lets an authenticated viewer-role WOPI user send crafted WebSocket messages that execute document-mutating UNO commands and dialog operations inside the live per-document kit process, despite holding a read-only session. The attacker cannot save the document and the changes are discarded when the kit session ends, so real-world impact is limited to misleading co-viewers in the same live session or having an authorized editor unknowingly persist the edits - matching the 4.3 CVSS (integrity low, no confidentiality or availability impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); the vendor has released fixed versions 24.04.18 and 25.04.11.
Reflected HTML injection in Collabora Online's cool.html editor page allows an unauthenticated remote attacker to inject markup through the host_session_id query/form parameter, which was substituted without HTML encoding; exploitation requires inducing a victim to load a crafted URL. Script execution and theft of the session authentication token and page contents occur only when an effective Content Security Policy is absent, and coolwsd sends a CSP header by default, so realistic script-execution exploitation requires a reverse proxy that strips or fails to preserve that header. The issue affects coolwsd before 24.04.18 and before 25.04.11 and is fixed in those releases; no CISA KEV entry or public exploit code was identified at time of analysis, and the vendor rates it medium severity (NVD CVSS 3.1 base 4.7).
Configuration-dependent OS command injection in Collabora Online's richdocumentscode proxy can let remote attackers execute commands on Nextcloud deployments that expose the proxy through an intermediate reverse proxy. Affected installations are Collabora Online/richdocumentscode versions prior to 25.04.702; public exploit code exists, but the provided data contains no CISA KEV confirmation of active exploitation and EPSS is low at 0.50% (66th percentile). Exploitation requires the specific Nextcloud plus richdocumentscode plus reverse-proxy topology, so default or non-proxied deployments are not necessarily vulnerable.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Read-only session enforcement bypass in Collabora Online before 24.04.18 and 25.04.11 lets an authenticated viewer-role WOPI user send crafted WebSocket messages that execute document-mutating UNO commands and dialog operations inside the live per-document kit process, despite holding a read-only session. The attacker cannot save the document and the changes are discarded when the kit session ends, so real-world impact is limited to misleading co-viewers in the same live session or having an authorized editor unknowingly persist the edits - matching the 4.3 CVSS (integrity low, no confidentiality or availability impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); the vendor has released fixed versions 24.04.18 and 25.04.11.
Reflected HTML injection in Collabora Online's cool.html editor page allows an unauthenticated remote attacker to inject markup through the host_session_id query/form parameter, which was substituted without HTML encoding; exploitation requires inducing a victim to load a crafted URL. Script execution and theft of the session authentication token and page contents occur only when an effective Content Security Policy is absent, and coolwsd sends a CSP header by default, so realistic script-execution exploitation requires a reverse proxy that strips or fails to preserve that header. The issue affects coolwsd before 24.04.18 and before 25.04.11 and is fixed in those releases; no CISA KEV entry or public exploit code was identified at time of analysis, and the vendor rates it medium severity (NVD CVSS 3.1 base 4.7).
Configuration-dependent OS command injection in Collabora Online's richdocumentscode proxy can let remote attackers execute commands on Nextcloud deployments that expose the proxy through an intermediate reverse proxy. Affected installations are Collabora Online/richdocumentscode versions prior to 25.04.702; public exploit code exists, but the provided data contains no CISA KEV confirmation of active exploitation and EPSS is low at 0.50% (66th percentile). Exploitation requires the specific Nextcloud plus richdocumentscode plus reverse-proxy topology, so default or non-proxied deployments are not necessarily vulnerable.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Collabora Online is a collaborative online office suite. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.