CVE-2026-84282

This flaw is like a “remote-controlled door” inside your software settings. If someone has administrative access to the plugin settings, they may be able to make your ownCloud server reach out to computers inside your private network—machines it normally shouldn’t contact.

Even though it doesn’t let them directly view private data, it can reveal which internal ports are open based on how the server responds, which helps them plan further attacks.

This matters if you use ONLYOFFICE’s ownCloud Integration plugin version 9.12 inside an ownCloud server. The key requirement is that the attacker must have an authenticated administrator account on your ownCloud instance and be able to change the vulnerable plugin settings.

It’s only a risk when the vulnerable plugin is installed and an attacker can reach the relevant plugin settings as an administrator (reachability from the internet isn’t the main gate here—admin access is).

This is RED because the issue is an SSRF that enables internal network reconnaissance (mapping private hosts and open ports) using only administrator-level access, and the attacker can do it without needing user interaction. Even without a known public exploit, the impact is targeted and can enable follow-on compromise.

Act now to reduce who can change plugin settings, and get vendor guidance on a fix since the available information does not include a patch.