Richdocuments
Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:richdocuments:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Richdocuments (cf413412-3453-5529-841e-45fdb3005a57) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/richdocuments |
purl2cpe | 2026-06-01 10:17:59.371043 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-67400 |
vulnerable | 2026-11-03 10:16:18.413981 |
Details available
LOW (3.5)
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
Published: 2026-10-27T16:15:34.773Z
Updated: 2026-11-04T20:25:23.074Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28645 |
vulnerable | 2026-06-08 06:01:14.626376 |
Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
MEDIUM (5.7)
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
Published: 2023-03-31T22:08:14.938Z
Updated: 2025-02-11T17:18:39.881Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25159 |
vulnerable | 2026-06-08 05:56:08.606431 |
Nextcloud Server previews are accessible without a watermark
LOW (2.3)
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get applied. This issue is fixed in Nextcloud Server 25.0.1 and 24.0.8, Nextcloud Enterprise Server 25.0.1 and 24.0.8, and Nextcloud Office (Richdocuments) App 7.0.1 (for 25) and 6.3.1 (for 24). No known workarounds are available.
Published: 2023-02-13T16:43:12.227Z
Updated: 2025-03-10T21:12:55.940Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25150 |
vulnerable | 2026-06-08 05:56:08.581802 |
Document content of files can be obtained through Collabora for files of other users
MEDIUM (5.8)
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
Published: 2023-02-08T19:15:47.344Z
Updated: 2025-03-10T21:14:57.395Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31024 |
vulnerable | 2026-06-08 05:43:40.002315 |
Federated editing allows iframing remote servers by default in richdocuments
MEDIUM (6.5)
richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.
Published: 2022-06-02T18:25:11.000Z
Updated: 2025-04-23T18:19:40.933Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39223 |
vulnerable | 2026-06-08 05:33:49.222158 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37629 |
vulnerable | 2026-06-08 05:32:54.514885 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37628 |
vulnerable | 2026-06-08 05:32:54.514293 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32748 |
vulnerable | 2026-06-08 05:32:07.945275 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.