CVE-2026-120489
MediumCVSS 4.3Summary
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
Risk Assessment
Unauthorized publishing into private collections may lead to phishing content distribution within a trusted environment. The risk affects Outline instances with multiple permission levels.
Recommendation
Update Outline to version 1.12.0 or later. Review member permissions and monitor unusual document publishing operations.
Other vulnerabilities in Outline
See all- CVE-2026-120449Medium
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can read withdrawn content, while shares.revoke returns 404 and blocks revocation.
- CVE-2026-43887High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.
- CVE-2026-43886High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.
- CVE-2026-113611Medium
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
- CVE-2026-41649High
Outline versions 0.86.0 through 1.7.0 contain an insecure direct object reference (IDOR) vulnerability in the `shares.create` API endpoint. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents from other workspaces.
- CVE-2025-58351Medium
Outline versions 0.72.0 through 0.83.0 introduced local file system storage as an optional file storage strategy. This feature allowed a CSP bypass and a ContentType bypass that might facilitate further attacks. In self-hosting with FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass CSP restrictions, allowing script execution within another user's context. Fixed in version 0.84.0.
Original NVD description (English source)
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS