CVE-2026-90631
Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Description
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OpenOffice | ≤4.1.16 |
Affected configurations (NVD)
CPE applicability statements from the NVD's analysis: 1 configuration, 1 CPE match. In a configuration marked “all of”, the vulnerable product is affected only together with the others listed (for example the hardware it runs on).
CPE matches
| # | CPE | Versions | Role |
|---|---|---|---|
| 1 | apache openofficecpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:* |
< 4.1.17 | vulnerable |
References
External links from the record. They lead to third-party sites.