CVE-2022-26307

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.

• CWE-326

• http://www.openwall.com/lists/oss-security/2022/08/13/2Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/08/13/2Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307Vendor Advisory

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26301TuziCMS v2.0.6 was discovered to contain a SQL injection vul…9.8
• CVE-2022-26302Heap-based buffer overflow exists in the simulator module co…7.8
• CVE-2022-26303An external config control vulnerability exists in the OAS E…7.5
• CVE-2022-26304Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-26305An Improper Certificate Validation vulnerability in LibreOff…7.5
• CVE-2022-26306LibreOffice supports the storage of passwords for web connec…7.5
• CVE-2022-26308Pandora FMS v7.0NG.760 and below allows an improper access c…5.4
• CVE-2022-26309Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in …8.8
• CVE-2022-2631Improper Access Control in GitHub repository tooljet/tooljet…8.8
• CVE-2022-26310Pandora FMS v7.0NG.760 and below allows an improper authoriz…8.8
• CVE-2022-26311Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Info…7.5
• CVE-2022-26313A vulnerability has been identified in Mendix Forgot Passwor…9.8