CVE-2026-27435: Missing Authorization in WofficeIO Woffice 5.4.33 – CVSS 5.3 MEDIUM

Technical summary

CVE-2026-27435 is a missing authorization flaw (CWE-862) in WofficeIO's Woffice product. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before granting access to sensitive operations. The flaw is network-accessible, requires no special authentication, and has low complexity, allowing remote exploitation without user interaction to achieve integrity impacts.

Business impact

An attacker exploiting this vulnerability could modify application data, alter configurations, or corrupt business-critical information without proper authorization. While the vulnerability does not allow data disclosure or service disruption, unauthorized modifications could compromise data integrity, violate compliance requirements, and undermine audit trails and accountability controls that depend on proper access enforcement.

Affected systems

Woffice versions prior to 5.4.33 are vulnerable. Organizations running this product should audit their deployment version immediately. The vendors_products field in the source data is empty, suggesting this may be a third-party or specialty product; verify your exact version through your deployment documentation or the Woffice admin interface.

Exploitability

This is a network-reachable vulnerability requiring no authentication or user interaction, making it relatively straightforward to exploit from an external perspective. However, actual exploitation depends on understanding the specific access control configurations within your Woffice deployment and identifying which operations or resources are inadequately protected. Public exploit code is not widespread, but the attack surface is accessible to anyone on the network.

Remediation

Upgrade to Woffice 5.4.33 or later, which addresses the missing authorization checks. Before patching, conduct a risk assessment to identify which Woffice instances are internet-facing or accessible to untrusted networks, and prioritize those for immediate remediation. Review and enforce access control policies to ensure least-privilege principles are applied within Woffice.

Patch guidance

Apply the patch to Woffice version 5.4.33 or higher. Test the update in a non-production environment first to ensure compatibility with your configurations and integrations. After deployment, verify that access control rules are functioning as intended by testing role-based operations. Document the patching date and confirm version updates across all Woffice instances in your environment.

Detection guidance

Monitor Woffice access logs for unauthorized attempts to perform operations that should be restricted by security levels. Look for API calls or requests to administrative or sensitive endpoints from accounts without appropriate permissions. Check for suspicious changes to application configurations, user roles, or data modifications that occur outside normal business activities. Network monitoring for unexpected outbound connections from Woffice may also indicate exploitation attempts.

Why prioritize this

Although this vulnerability is scored MEDIUM severity (CVSS 5.3) and does not enable remote code execution or data theft, the combination of network accessibility, no authentication required, and integrity impact warrants prompt attention. Any vulnerability allowing unauthorized modification without authentication represents a meaningful risk to data integrity and compliance posture, particularly if Woffice handles sensitive business processes or user information.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a MEDIUM severity rating driven by network accessibility and low attack complexity, tempered by the absence of confidentiality or availability impact. The vulnerability affects integrity only, meaning an attacker can modify data but cannot read sensitive information or take the service offline. Organizations with strict data integrity requirements or heavy reliance on Woffice for critical workflows may assess their internal risk higher than the base score suggests.

Frequently asked questions