CVE-2026-67400 in Richdocuments
Summary
by MITRE • 10/27/2026
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described involves a critical authentication and authorization flaw within the Web Application Open Platform Interface, commonly known as WOPI, which is frequently utilized by cloud-based document collaboration services such as Microsoft 365. The core technical deficiency lies in the server-side validation logic governing API endpoints that expose configuration metadata or internal state information about hosted documents. Specifically, when a client application requests this configuration data using either an authenticated user token or a guest access token, the system fails to verify the presence and validity of a required token type parameter. This missing check creates a condition where the server processes the request without ensuring that the caller possesses the specific privileges associated with the intended operation, effectively bypassing granular access controls designed to restrict sensitive configuration data to authorized administrative contexts or strictly scoped application identities.
From an architectural perspective, this flaw represents a classic instance of broken object level authorization combined with insufficient input validation on security-critical parameters. The WOPI protocol relies heavily on tokens to establish trust between the host service and the client accessing it. By omitting the verification of the token type, the system treats all valid authentication credentials as equivalent for the purpose of retrieving configuration details, regardless of whether they belong to a standard user, an external guest, or potentially even unauthenticated entities if other checks are also lax. This oversight allows attackers who have obtained low-privilege credentials, such as those belonging to a regular employee or a collaborator with limited access rights, to enumerate internal system configurations that should remain hidden from their scope of authority.
The operational impact of this vulnerability is significant for organizations relying on these cloud services for sensitive data management. An attacker exploiting this flaw can retrieve detailed WOPI configuration information, which may include endpoints, feature flags, security policies, and integration settings specific to the tenant or organization. This intelligence gathering phase enables further reconnaissance efforts, allowing adversaries to map out the attack surface more accurately. With knowledge of these configurations, an attacker could identify potential weaknesses in third-party integrations, discover undocumented API endpoints, or tailor subsequent attacks such as cross-site request forgery or token manipulation attempts against specific features that are enabled but poorly secured for lower-privilege users.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically the failure to enforce proper authorization checks before granting access to resources. It also maps closely to MITRE ATT&CK technique T1087, Account Discovery, as it facilitates the enumeration of account-related configurations and permissions within a cloud environment. The lack of token type verification is particularly dangerous because it undermines the principle of least privilege, allowing users with minimal rights to access information that could aid in lateral movement or escalation attacks within the tenant's ecosystem.
Mitigation strategies must focus on enforcing strict validation at the API gateway level as well as within the application logic itself. Developers should implement mandatory checks for all required security parameters, ensuring that every request includes and validates a token type field before processing any sensitive configuration data. Additionally, implementing role-based access control mechanisms will ensure that only users with specific administrative or service account roles can retrieve WOPI configurations. Regular penetration testing focused on authorization bypasses and automated static code analysis tools configured to detect missing security parameter checks are essential for identifying such flaws early in the development lifecycle. Organizations should also monitor logs for unusual patterns of configuration requests originating from low-privilege accounts, as this may indicate active exploitation attempts against similar vulnerabilities.