CVE-2026-38587
Medium
Description
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. This allows authenticated users with low-level permissions (User or Guest) to retrieve sensitive information, such as the Owner's unique identifier (ID) and profile information, which should only be accessible to administrators.
SeverityMedium
CVSS4.3
Exploit probability—
ProductDocSpace
PublishedMay 26, 2026
First seenMay 26, 2026
How to fix
Update
- ONLYOFFICE DocSpace3.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ONLYOFFICE DocSpace | No range specified | 3.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.