In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ascensio
  • Onlyoffice Desktopeditors

No data.

No data.

References
Link Providers
https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md cve-icon cve-icon
History

Thu, 16 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Ascensio
Ascensio onlyoffice Desktopeditors
Vendors & Products Ascensio
Ascensio onlyoffice Desktopeditors

Thu, 16 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Update Service in ONLYOFFICE DesktopEditors

Thu, 16 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Description In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.
Weaknesses CWE-669
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-04-16T05:51:21.338Z

Updated: 2026-04-16T12:31:19.989Z

Reserved: 2026-04-16T05:51:20.922Z

Link: CVE-2026-41030

cve-icon Vulnrichment

Updated: 2026-04-16T12:20:11.963Z

cve-icon NVD

Status : Received

Published: 2026-04-16T07:16:30.660

Modified: 2026-04-16T07:16:30.660

Link: CVE-2026-41030

cve-icon Redhat

No data.