CVE-2021-32744

Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to guess the file identifier - the predictability of this file identifier is dependent on external file-storage implementations (this is a potential "IDOR" - Insecure Direct Object Reference - vulnerability). Versions 4.2.17-1 and 6.4.9-5 contain patches for this issue. There is no known workaround except updating the Collabora Online application to one of the patched releases.

• CWE-639
• CWE-639

• https://github.com/CollaboraOnline/online/security/advisories/GHSA-32xj-9x82-q9jwThird Party Advisory
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-32xj-9x82-q9jwThird Party Advisory

Published

Jul 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32738js-stellar-sdk is a Javascript library for communicating wit…6.5
• CVE-2021-32739Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32740Addressable is an alternative implementation to the URI impl…7.5
• CVE-2021-32741Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32742Vapor is a web framework for Swift. In versions 4.47.1 and p…9.1
• CVE-2021-32743Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1
• CVE-2021-32746Icinga Web 2 is an open source monitoring web interface, fra…5.3
• CVE-2021-32747Icinga Web 2 is an open source monitoring web interface, fra…6.5
• CVE-2021-32748Nextcloud Richdocuments in an open source self hosted online…4.3
• CVE-2021-32749fail2ban is a daemon to ban hosts that cause multiple authen…8.1
• CVE-2021-3275Unauthenticated stored cross-site scripting (XSS) exists in …6.1