A high-severity missing authorization vulnerability in Apache OpenOffice allows unauthenticated attackers to exfiltrate or manipulate external data via malicious spreadsheet documents.

This is a missing authorization vulnerability (CWE-862) occurring within the DDE link handling functionality of Apache OpenOffice Calc. An unauthenticated attacker can craft a spreadsheet document that, when opened, silently loads external file contents without prompting the user for necessary permissions.

The ability to access external files without user consent poses a significant risk to data confidentiality and integrity. If an attacker directs the application to load sensitive system files or configuration data, it could lead to unauthorized information disclosure or facilitate further downstream attacks. Given the CVSS score of 7.5, this vulnerability represents a substantial risk to internal security postures.

Immediate Action: Upgrade Apache OpenOffice to version 4.1.16 or later to address the missing authorization flaw.

Proactive Monitoring: Review file access logs for unusual patterns involving DDE or external link requests originating from the office suite.

Compensating Controls: Implement endpoint protection policies that restrict the ability of desktop applications to initiate unauthorized outbound network connections or access restricted system directories.

Public Exploit Available: Unknown

Organizations should prioritize the deployment of Apache OpenOffice version 4.1.16 across all workstations. Because this vulnerability is automatable and requires no user interaction beyond opening a document, the risk of exploitation via phishing or document-based campaigns is elevated. Ensure that all users are updated to the patched version to mitigate this risk.