CVE-2023-6186

Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.

• CWE-281

• https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/Mailing List, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5574Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/Mailing List, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5574Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186Vendor Advisory

Published

Dec 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6178 An arbitrary file write vulnerability exists where an authe…6.5
• CVE-2023-6179Honeywell ProWatch, 4.5, including all Service Pack versions…7.8
• CVE-2023-6180The tokio-boring library in version 4.0.0 is affected by a m…5.3
• CVE-2023-6181An oversight in BCB handling of reboot reason that allows fo…9.8
• CVE-2023-6184Cross SiteScripting vulnerability in Citrix Session Recordin…7.2
• CVE-2023-6185Improper Input Validation vulnerability in GStreamer integra…8.8
• CVE-2023-6187The Paid Memberships Pro plugin for WordPress is vulnerable …8.8
• CVE-2023-6188A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It …9.8
• CVE-2023-6189Missing access permissions checks in the M-Files server be…5.3
• CVE-2023-6190Improper Limitation of a Pathname to a Restricted Directory …9.8
• CVE-2023-6191Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-6193quiche v. 0.15.0 through 0.19.0 was discovered to be vulnera…5.3