CVE-2026-90631

Low

Description

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.

SeverityLow

CVSS3.3

Exploit probability—

Product

Apache Openoffice

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-939CWE-939

How to fix

Update

apache openoffice4.1.17 or later

Vendor advisories

lists.apache.org/thread.html/j19rrk8jwrlg41tj6rfdcccj8cyyxhz9

Affected products

Product	Affected versions	Fixed in
apache openoffice	v < 4.1.17	4.1.17

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.