CVE-2026-110652 ONLYOFFICE CVE debrief

Who should care

Defenders responsible for ONLYOFFICE DocumentServer instances, especially those with JWT verification disabled, should assess potential exposure and impact on internal networks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, implement necessary controls, and monitor for potential security incidents.

Why it matters

The CVE-2026-110652 vulnerability in ONLYOFFICE DocumentServer before version 10.0.0 allows remote attackers to bypass private-IP request filtering, potentially exposing internal networks and sensitive metadata. Defenders should verify exposure, assess impact, and implement necessary controls.

• Potential exposure of internal networks to unauthorized access
• Possible leakage of sensitive private-network and cloud metadata content
• Bypass of private-IP request filtering mechanisms
• Verification of ONLYOFFICE DocumentServer version and configuration

Technical summary

The ONLYOFFICE DocumentServer before version 10.0.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /downloadfile/:docid endpoint. The vulnerability allows remote attackers to bypass private-IP request filtering by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. This can lead to fetching and proxying arbitrary private-network and cloud metadata content. Defenders should prioritize verifying exposure of ONLYOFFICE DocumentServer instances, especially those with JWT verification disabled, and assess potential impact on internal networks.

Defensive priority

Defenders should prioritize verifying exposure of ONLYOFFICE DocumentServer instances, especially those with JWT verification disabled, and assess potential impact on internal networks.

Recommended defensive actions

• Verify ONLYOFFICE DocumentServer version and configuration
• Assess exposure of internal networks
• Implement JWT verification
• Restrict access to /downloadfile/ endpoint
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is confirmed in ONLYOFFICE DocumentServer versions before 10.0.0. The default configuration has JWT verification disabled, which allows for exploitation of the isInJwtToken bypass. Evidence limits are based on public CVE details and vendor documentation. Defenders should verify ONLYOFFICE DocumentServer version, configuration, and potential exposure of internal networks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.