CVE-2026-120449

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

Outline versions 0.86.0 through 1.7.0 contain an insecure direct object reference (IDOR) vulnerability in the `shares.create` API endpoint. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents from other workspaces.

Outline versions 0.72.0 through 0.83.0 introduced local file system storage as an optional file storage strategy. This feature allowed a CSP bypass and a ContentType bypass that might facilitate further attacks. In self-hosting with FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass CSP restrictions, allowing script execution within another user's context. Fixed in version 0.84.0.