Token Type Validation Flaw in WOPI Configuration for Microsoft Products
CVE-2026-67400

3.5LOW

Key Information:

Vendor

Nextcloud
Status
Richdocuments
Vendor
CVE Published:
27 October 2026

What is CVE-2026-67400?

A flaw in the WOPI configuration allows attackers to exploit a missing token type check, potentially enabling them to access sensitive information. This issue arises when user or guest tokens are incorrectly processed, leading to the possibility of unauthorized data retrieval regarding WOPI configurations. It is crucial for users to ensure their implementations are secure and to apply necessary mitigations to safeguard against potential exploitation.

Affected Version(s)

Richdocuments 11.0.0

References

https://hackerone.com/reports/3568116

CVSS V3.0

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ibrahim el zein (bornwinnerrr)
.