Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.
CVE-2026-90631
CVSS base score
3.3 (v3.1)
Severity
LOW
Attack vector
Local
Weakness
CWE-939
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
apache openoffice
References
- lists.apache.org Mailing List, Vendor Advisory
- www.openwall.com Mailing List, Third Party Advisory