CVE-2026-120489
mediumOutline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents in…
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L1... disclosure@vulncheck.com
- https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc disclosure@vulncheck.com
- https://github.com/outline/outline/releases/tag/v1.12.0 disclosure@vulncheck.com
- https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-aut... disclosure@vulncheck.com