In ONLYOFFICE DesktopEditors versions prior to 9.3.0, the update service can be exploited to execute actions on files with SYSTEM privileges. This flaw is rooted in improper privilege management, allowing attackers who obtain the ability to influence the update process to elevate privileges or run code with elevated rights, undermining confidentiality, integrity, and availability of the system it runs on. The weakness is categorized as CWE-669.

The affected vendor is Ascensio, product is ONLYOFFICE DesktopEditors. All builds before 9.3.0 are vulnerable. Users running any earlier version on any supported operating system are at risk.

The CVSS score of 6.2 indicates medium severity. EPSS data is unavailable, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the update service; an attacker would need to supply a malicious update package or compromise the update server. Once triggered, the attacker could take actions with SYSTEM‑level privileges, making this a critical escalation vector in environments where the DesktopEditors service runs under privileged accounts.