CVE-2026-41649
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Outline versions 0.86.0 through 1.7.0 contain an insecure direct object reference (IDOR) vulnerability in the `shares.create` API endpoint. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents from other workspaces.
Risk Assessment
An attacker can access the contents of any document in the organization, including sensitive data, by generating a public share link and retrieving the document via the `documents.info` endpoint.
Recommendation
Immediately update Outline to version 1.7.0 or later, which contains a patch for this vulnerability.
Other vulnerabilities in Outline
See all- CVE-2026-120489Medium
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
- CVE-2026-120449Medium
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can read withdrawn content, while shares.revoke returns 404 and blocks revocation.
- CVE-2026-43887High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.
- CVE-2026-43886High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.
- CVE-2026-113611Medium
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
- CVE-2025-58351Medium
Outline versions 0.72.0 through 0.83.0 introduced local file system storage as an optional file storage strategy. This feature allowed a CSP bypass and a ContentType bypass that might facilitate further attacks. In self-hosting with FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass CSP restrictions, allowing script execution within another user's context. Fixed in version 0.84.0.
Original NVD description (English source)
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS