CVE-2026-6572

CVE-2026-6572 is an improper authorization vulnerability affecting Collabora KodExplorer versions up to 4.52, specifically in the fileUpload endpoint at /app/controller/share.class.php. The flaw allows manipulation of the fileUpload argument to bypass authorization controls, potentially exposing sensitive functionality to unauthorized access. The vulnerability has a CVSS score of 5.6 (Medium severity) with a network-based attack vector requiring no user interaction or privileges. However, the attack complexity is rated as high, meaning successful exploitation is difficult and requires specific conditions. The potential impact is limited to partial compromise of confidentiality, integrity, and availability. Regarding exploitation status, the vulnerability is not currently listed on the CISA KEV catalog and shows no active exploitation in the wild based on available threat intelligence. While proof-of-concept exploit code has been publicly disclosed, the EPSS score of 0.00012 indicates minimal probability of real-world exploitation. The vendor was notified early but provided no response, and community attention remains low based on the FAUCET risk score of 42.0/100.