Apache OpenOffice documents load external links without prompt (CVE-2026-90631)
Original title: CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Apache OpenOffice through 4.1.16 allows external links to load without prompt, potentially leaking environment variables.
A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. This could transfer the contents of environment variables. The issue affects versions through 4.1.16.
- Users recommended to upgrade to version 4.1.17
- Issue discovered by Anthropic and Ada Logics
Impact: Remote document loading without prompt
| Product | Affected | Fixed in |
|---|---|---|
| Apache OpenOffice | through 4.1.16 | 4.1.17 |
- 1.Upgrade to version 4.1.17
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90631 | — | — | — |
From the original article
Posted by Arrigo Marchiori on Nov 03 Severity: important Affected versions: - Apache OpenOffice through 4. 1. 16 Description: Apache OpenOffice documents can contain links.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.