Authorization Vulnerability in Apache OpenOffice Affects Sensitive Links
CVE-2026-90631

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Openoffice
Vendor
CVE Published:
4 November 2026

What is CVE-2026-90631?

Apache OpenOffice contains an authorization flaw that allows malicious documents to load external links without user confirmation. This vulnerability could result in the unintentional exposure of environment variable contents. It is crucial for users to upgrade to version 4.1.17 or later to mitigate this risk and enhance document security.

Affected Version(s)

Apache OpenOffice 0 <= 4.1.16

References

https://lists.apache.org/thread.html/j19rrk8jwrlg41tj6rfd...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edoardo Geraci and Thomas Rinsma of Codean Labs
.