Is CVE-2026-38587 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38587 being exploited in the wild.

How severe is CVE-2026-38587?

Informational severity, with a CVSS score of 0, published 26 May 2026.

Which products and versions are affected?

ONLYOFFICE DocSpace before 3.2.1.

Is there a fix for CVE-2026-38587?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38587 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38587?

Check whether you run ONLYOFFICE DocSpace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38587: ONLYOFFICE DocSpace IDOR in REST API endpoints

CVE-2026-38587 · Severity: info · CVSS 0 · Published 2026-05-26

ONLYOFFICE DocSpace is a collaborative platform for managing and editing documents. A security flaw was found where low-level users or guests could access sensitive administrative information, such as profile details and unique identifiers of the system owner. This could lead to unauthorized information disclosure and assist in further targeted attacks against the platform's administrators.

Vendors: ONLYOFFICE.

Quick answers

Is CVE-2026-38587 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38587 being exploited in the wild.
How severe is CVE-2026-38587?: Informational severity, with a CVSS score of 0, published 26 May 2026.
Which products and versions are affected?: ONLYOFFICE DocSpace before 3.2.1.
Is there a fix for CVE-2026-38587?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38587 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38587?: Check whether you run ONLYOFFICE DocSpace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in multiple REST API endpoints of ONLYOFFICE DocSpace prior to version 3.2.1. The vulnerability stems from insufficient authorization checks when accessing specific object identifiers. An authenticated attacker with 'User' or 'Guest' permissions can manipulate API requests to retrieve sensitive data, including the Owner's unique identifier (ID) and profile information, which is intended to be restricted to administrators. The issue is resolved in version 3.2.1.

Affected products

ONLYOFFICE DocSpace before 3.2.1

Timeline

2026-05-26: advisory: CVE-2026-38587 published by NVD
2026-05-26: disclosed: Vulnerability disclosed in ONLYOFFICE DocSpace changelog

References

https://github.com/ONLYOFFICE/DocSpace/blob/master/CHANGELOG.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.