CVE-2026-90631

Published: Nov 4, 2026Modified: Nov 4, 2026

Description

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.

Related CWEs

CWE-939

Improper Authorization in Handler for Custom URL Scheme

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References (1)

https://lists.apache.org/thread.html/j19rrk8jwrlg41tj6rfdcccj8cyyxhz9

Source: security@apache.org

Timeline

No history available yet.