What is CVE-2026-90631?

CVE-2026-90631 is a low-severity vulnerability in Apache Openoffice, classified under CWE-939. CVSS score: 3.3/10. Published 2026-11-04.

How severe is CVE-2026-90631?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Apache Openoffice

CVE-2026-90631

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue affects Apache OpenOffice: through 4.1.16. Users are recommended to upgrade to version 4.1.17, which fixes the issue.

Published 2026-11-04 · last modified 2026-11-04.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-939

References

lists.apache.org/thread.html/j19rrk8jwrlg41tj6rfdcccj8cyyxhz9 (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-90631?: CVE-2026-90631 is a low-severity vulnerability in Apache Openoffice, classified under CWE-939. CVSS score: 3.3/10. Published 2026-11-04.
How severe is CVE-2026-90631?: Low severity. CVSS v3 base score is 3.3 out of 10.