CVE-2026-67400: Low severity vulnerability
Published Oct 27, 2026
·Updated
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
Event History
Oct 27, 2026
CVE Published
via MITRE·04:15 PM
Data Sourced
via MITRE·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs a valid user or guest token and must interact with the affected functionality. The vector also indicates user interaction is required.
2
What information could be exposed?
The issue allows retrieval of additional information about the WOPI configuration. The available data rates the confidentiality impact as low and does not identify the specific configuration details exposed.
3
Does this vulnerability affect integrity or availability?
No integrity or availability impact is indicated. The supplied vector identifies low confidentiality impact only.