CVE-2021-32744

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to guess the file identifier - the predictability of this file identifier is dependent on external file-storage implementations (this is a potential "IDOR" - Insecure Direct Object Reference - vulnerability). Versions 4.2.17-1 and 6.4.9-5 contain patches for this issue. There is no known workaround except updating the Collabora Online application to one of the patched releases.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327456.1Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-CVE-2021-327465.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` m CVE-2021-327476.5Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables ar CVE-2021-327484.3Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") pro CVE-2021-327498.1fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 CVE-2021-32756.1Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access P CVE-2021-327505.7MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop cli CVE-2021-327517.5Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and t CVE-2021-327524.9Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to CVE-2021-327536.5EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists i CVE-2021-327545.3FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed CVE-2021-327554.3Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implement