CVE-2026-46499: Collabora Online: Read-only session authorization bypass permits live document edits
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Collabora Onlineto a version that resolves this vulnerability.Fixed in 24.04.18 - Upgrade
Upgrade
Collabora Onlineto a version that resolves this vulnerability.Fixed in 25.04.11
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A user who already has a read-only session, such as a viewer-role WOPI user, can exploit it. The attacker must be able to send crafted WebSocket messages to the affected Collabora Online session.
Are document changes automatically persisted?
No. A read-only attacker cannot save the document directly, and their changes are discarded when the kit session ends unless an authorized editor sharing the session saves the modifications.
What is the practical impact during a shared editing session?
An attacker can perform document-mutating UNO commands and dialog operations despite the read-only interface. These changes can mislead other users viewing the live session, and an authorized editor may unknowingly save them.
Which versions contain the fix?
The issue is fixed in Collabora Online versions 24.04.18 and 25.04.11. Versions prior to those releases are affected.