CVE-2026-23623 is an improper authorization vulnerability (CWE-285) found in Collabora Online, a web-based collaborative office suite derived from LibreOffice technology. The vulnerability exists in versions prior to 23.05.20.1, 24.04.17.3, 25.04.7.5, and the Development Edition before 25.04.08.2. It allows a user who has only view permissions and explicitly no download rights to circumvent these restrictions and download a local copy of a shared file. This is achieved by pressing the keyboard shortcut Ctrl+Shift+S, which triggers the file download process even though the user interface does not provide any download buttons or options for such users. The flaw arises from insufficient enforcement of authorization checks on the download functionality, permitting unauthorized data exfiltration. The vulnerability does not require any prior authentication or elevated privileges beyond view-only access, nor does it require additional user interaction beyond the shortcut key press. The CVSS v3.1 base score is 5.3 (medium), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality loss without affecting integrity or availability. No known exploits are reported in the wild as of the publication date. The issue has been addressed in the specified patched versions, which enforce proper authorization checks to prevent unauthorized downloads.

For European organizations, this vulnerability poses a risk of unauthorized data disclosure, particularly in environments where sensitive or confidential documents are shared via Collabora Online. Since the flaw allows users with only view permissions to download files without explicit authorization, it undermines data access policies and confidentiality controls. This can lead to leakage of intellectual property, personal data, or regulated information, potentially violating GDPR and other data protection regulations. The impact is more pronounced in sectors such as government, finance, healthcare, and legal services, where document confidentiality is critical. Although the vulnerability does not affect data integrity or system availability, the confidentiality breach alone can result in reputational damage, regulatory penalties, and loss of trust. The ease of exploitation—requiring only a keyboard shortcut—means that insider threats or compromised accounts with view access can readily exploit this flaw. Organizations relying on Collabora Online for collaborative document editing and sharing must consider this risk in their threat models.

The primary mitigation is to upgrade Collabora Online to the patched versions: 23.05.20.1, 24.04.17.3, 25.04.7.5, or Development Edition 25.04.08.2 or later. Organizations should implement strict version control and patch management processes to ensure timely application of security updates. Additionally, review and tighten access control policies to minimize the number of users granted view-only access to sensitive documents. Employ monitoring and logging to detect unusual download activities, including keyboard shortcut usage or unexpected file downloads. Consider disabling or restricting keyboard shortcuts in the web interface if feasible until patches are applied. Conduct user training to raise awareness about potential unauthorized data access methods. For environments with high confidentiality requirements, implement additional data loss prevention (DLP) controls to monitor and block unauthorized file downloads. Finally, perform regular security audits and penetration testing to verify that access controls are correctly enforced.