This vulnerability in ONLYOFFICE DocSpace (pre-3.2.1) involves improper access control in several REST API endpoints. Authenticated users with minimal privileges can retrieve sensitive data intended only for administrators, specifically the Owner's unique ID and profile information. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact.

The impact is limited to unauthorized disclosure of sensitive information (Owner's unique identifier and profile data) to authenticated users with low-level permissions. There is no indication of data modification or service disruption. This could lead to privacy concerns or information leakage but does not directly enable system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ONLYOFFICE DocSpace REST API endpoints where possible and monitor for unusual access patterns. Avoid granting unnecessary permissions to low-level users. Follow vendor updates closely for any forthcoming patches or official mitigations.