ONLYOFFICE DocSpace Insecure Direct Object Reference Vulnerability Allowing Unauthorized Access to Owner Profile Information

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in ONLYOFFICE DocSpace versions prior to 3.2.1. This vulnerability exists in multiple REST API endpoints and allows authenticated users with low-level permissions (User or Guest) to access sensitive information, such as the Owner's unique identifier and profile details, which should be restricted to administrators.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including the Owner's unique identifier and profile details.

Remediation

Users can update to ONLYOFFICE DocSpace version 3.2.1 or later to address this vulnerability.