Apache OpenOffice can process links embedded in documents. A missing Authorization flaw allows an attacker to craft a document that auto‑loads external URLs without user confirmation. The automatic transfer of data can expose environment variables to the remote endpoint, potentially revealing system configuration details or credentials. The impact is the disclosure of sensitive information to an attacker that controls the linked resource.

Affected versions are Apache OpenOffice released by the Apache Software Foundation up to and including 4.1.16. Version 4.1.17 and newer contain the fix.

No CVSS score is publicly available, and the EPSS ingestion is currently marked as not available, so an exact exploitation probability cannot be quantified. It is listed as not present in the CISA KEV catalog. The plausible attack vector is a user opening a malicious document or attachment that contains the exploited link logic, which will automatically be fetched by the software. Because the flaw permits data to be sent to an arbitrary external server, a skilled adversary could capture environment variable contents or other user data.