CVE-2026-41030

Full vulnerability record from the local CVENow database.

Description

In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.

Severity

MEDIUM

CVSS score

6.2 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-04-16 07:16:30.660000

Last modified

2026-10-26 21:10:00.170000

View original CVE JSON

{
  "id": "CVE-2026-41030",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-16T07:16:30.660",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges."
    },
    {
      "lang": "es",
      "value": "En ONLYOFFICE DesktopEditors anteriores a 9.3.0, el servicio de actualización permite a los atacantes realizar acciones en archivos con privilegios de SYSTEM."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Ascensio",
          "product": "ONLYOFFICE DesktopEditors",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "9.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T12:20:10.591911Z",
          "id": "CVE-2026-41030",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-669"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md",
      "source": "[email protected]"
    }
  ]
}