CVE-2026-41649
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Outline versions 0.86.0 through 1.7.0 contain an insecure direct object reference (IDOR) vulnerability in the `shares.create` API endpoint. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents from other workspaces.
Risk Assessment
An attacker can access the contents of any document in the organization, including sensitive data, by generating a public share link and retrieving the document via the `documents.info` endpoint.
Recommendation
Immediately update Outline to version 1.7.0 or later, which contains a patch for this vulnerability.
Other vulnerabilities in Outline
See all- CVE-2026-43887High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.
- CVE-2026-43886High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.
Original NVD description (English source)
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.