CVE-2026-120449
mediumOutline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loade…
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77 disclosure@vulncheck.com
- https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52 disclosure@vulncheck.com
- https://github.com/outline/outline/releases/tag/v1.12.0 disclosure@vulncheck.com
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-pub... disclosure@vulncheck.com
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg 134c704f-9b21-4f2e-91b3-4a467353bcc0