CVE-2026-23623

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only rights and no download privileges can obtain a local copy of a shared file. Although there are no corresponding buttons in the interface, pressing Ctrl+Shift+S initiates the file download process. This allows the user to bypass the access restrictions and leads to unauthorized data retrieval. This issue has been patched in Collabora Online Development Edition version 25.04.08.2 and Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5.

• CWE-285

• https://github.com/CollaboraOnline/online/security/advisories/GHSA-68v6-r6qq-mmq2

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23618GFI MailEssentials AI versions prior to 22.4 contain a store…5.4
• CVE-2026-23619GFI MailEssentials AI versions prior to 22.4 contain a store…5.4
• CVE-2026-2362The WP Accessibility plugin for WordPress is vulnerable to S…6.4
• CVE-2026-23620GFI MailEssentials AI versions prior to 22.4 contain an arbi…5.3
• CVE-2026-23621GFI MailEssentials AI versions prior to 22.4 contain an arbi…5.3
• CVE-2026-23622Easy!Appointments is a self hosted appointment scheduler. In…8.8
• CVE-2026-23624GLPI is a free asset and IT management software package. In …6.5
• CVE-2026-23625OpenProject is an open-source, web-based project management …5.4
• CVE-2026-23626Kimai is a web-based multi-user time-tracking application. P…6.8
• CVE-2026-23627OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-2363The WP-Members Membership Plugin plugin for WordPress is vul…6.5
• CVE-2026-23630Docmost is open-source collaborative wiki and documentation …5.4