CVE-2026-23623: Collabora Online vulnerable to Authorization Bypass
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23623?
CVE-2026-23623 has a high severity rating due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2026-23623?
To address CVE-2026-23623, upgrade to Collabora Online Development Edition version 25.04.08.2 or Collabora Online versions 23.05.20.1, 24.04.17.3, or 25.04.7.5.
What are the affected versions for CVE-2026-23623?
CVE-2026-23623 affects Collabora Online Development Edition versions prior to 25.04.08.2 and Collabora Online versions between 23.05.20.1 to 24.04.17.3 and before 25.04.7.5.
What type of vulnerability is CVE-2026-23623?
CVE-2026-23623 is classified as an Authorization Bypass vulnerability.
Can CVE-2026-23623 lead to data exposure?
Yes, CVE-2026-23623 can lead to unauthorized access, potentially exposing sensitive data.