Onlyoffice Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Onlyoffice Server.
By the Year
In 2026 there have been 0 vulnerabilities in Onlyoffice Server. Server did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 6 | 7.38 |
It may take a day or so for new Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Onlyoffice Server Security Vulnerabilities
ONLYOFFICE SSRF via Document Editor Service
CVE-2021-43449
8.1 - High
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
SSRF
ONLYOFFICE Auth Bypass via Document Editor
CVE-2021-43447
7.5 - High
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
Missing Authentication for Critical Function
OnlyOffice XSS via Macro Feature in Document Editor
CVE-2021-43446
6.1 - Medium
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
XSS
ONLYOFFICE Incorrect Access Control via Default JWT Signing Key
CVE-2021-43445
9.8 - Critical
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
authentification
ONLYOFFICE Incorrect Access Control - Forged Doc URLs via Weak Signing Key
CVE-2021-43444
7.5 - High
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.
authentification
ONLYOFFICE Improper Input Validation Enables User Name Spoofing
CVE-2021-43448
5.3 - Medium
- January 23, 2023
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Onlyoffice Server or by Onlyoffice? Click the Watch button to subscribe.
