Outline CVE-2026-113611

Exploitation requires that the attacker previously held an Outline account with webhook-creation privileges (administrator level) AND registered a WebhookSubscription pointing to an endpoint they control BEFORE that account was permanently deleted (not suspended). After deletion, the orphaned subscription is never disabled, so the attacker's endpoint passively continues to receive DeliverWebhookTask payloads for every workspace event matching the subscription. Limiting factors: only data covered by the pre-existing subscription's event types is leaked; the attacker must have already set up the webhook while privileged; suspension (rather than deletion) and versions 1.8.0 and later are not affected. No user interaction by any current user is needed once the webhook exists.

This is a genuine but bounded data-exposure issue, not an emergency. The only severity signal in the input is a CVSS 4.0 base score of 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:H/UI:N and confidentiality-only impact (VC:H, VI:N, VA:N) - no CVSS 3.1 vector, no EPSS score, and no SSVC decision data were provided, so probabilistic exploitation likelihood cannot be quantified. KEV status is not present in the input, so this is NOT confirmed actively exploited; POC availability is likewise not indicated, so there is no public exploit identified at time of analysis. The PR:H requirement is the dominant mitigating factor: exploitation depends on an actor who previously held administrator (webhook-creation) privileges and who registered a WebhookSubscription before their account was deleted - this is an insider/former-insider threat, not a mass-exploitable remote flaw. Confidentiality impact is real and high (full document bodies including Markdown and Yjs data leak continuously), but the narrow precondition and absence of any exploitation telemetry make this a targeted, lower-urgency patch priority rather than a drop-everything issue. The vulnerability mechanism is well-corroborated: the vendor GHSA advisory, the VulnCheck advisory, and the patch commit all agree, and the fix (disabling WebhookSubscription rows on user deletion) is visible in source.

A disgruntled administrator at an Outline workspace registers a webhook subscription pointing to a server they control, then leaves the organization and has their account permanently deleted. Because deletion never disables their webhook rows, their endpoint keeps receiving full document contents for every matching workspace event long after they lost all legitimate access. No public exploit code is identified; exploitation is passive and requires no further action once the webhook is in place.