CVE-2026-46499 Collabora Online: Read-only session authorization bypass permits live document edits

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOP...

CVE-2026-46499

In Collabora Online versions prior to 24.04.18 and 25.04.11 , an authorization bypass allows read-only users (such as viewer-role WOPI users) to execute document-mutating UNO commands. This occurs because the LibreOfficeKit in the per-document kit process fails to enforce a session's read-only st...