Cyber ·
CVE-2026-90631: OpenOffice loads external links without warning and may expose environment variables
An missing authorization flaw in Apache OpenOffice up to version 4.1.16 can make documents load external links without warning, possibly exposing environment variable contents. Rated important in an advisory dated November 3, 2026 on the oss-sec list.
According to the advisory posted to the oss-sec list on November 3, 2026, Apache OpenOffice has a missing authorization vulnerability, identified as CVE-2026-90631 and rated important. OpenOffice documents can contain links. According to the advisory, an attacker can create a document that causes external links to be loaded without warning to the user, possibly transferring environment variable contents out during that process. The issue affects versions up to and including 4.1.16.
The available text is a machine translation of an English advisory and was cut off before the full recommendations section. The exact fix guidance is therefore not reproduced here and should be read in the original advisory.
To consult and verify, open the original advisory on the oss-sec discussion list, confirm the installed OpenOffice version against the affected range, and check the official Apache project channel for the fixed release. Do not rely on the machine translation alone.
Relevance to Rota Nacional: Rota does not patch or protect your local OpenOffice installation or its configuration, and it does not resolve this flaw. When document text is sent to the API, the platform detects personal data before any model runs and applies the organization's policy, but that does not replace updating the software.