What is the CVSS score of CVE-2026-43886?

CVE-2026-43886 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Outline are affected by CVE-2026-43886?

Outline versions 0.84.0-1.6.1 contain an OAuth scope validation flaw with publicly available exploit code that allows registered OAuth clients to escalate from read-only permissions to full…. A patch is available.

How to fix or mitigate CVE-2026-43886?

Within 24 hours, identify all Outline instances in your environment and confirm affected versions (0.84.0-1.6.1), then inventory active OAuth integrations and their authorization scopes. Within 7 days, apply the vendor-released patch to all affected instances and conduct an audit of recent OAuth token activity for evidence of scope escalation attempts. Within 30 days, complete a comprehensive OAuth application authorization review, revoke any high-risk integrations, and implement continuous monitoring for abnormal token scope elevation patterns.

Outline CVE-2026-43886

EUVD-2026-29330 HIGH

Improper Privilege Management (CWE-269)

2026-05-11 GitHub_M

Privilege Escalation Outline

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:34 vuln.today

Patch available

May 11, 2026 - 23:03 EUVD

CVE Published

May 11, 2026 - 21:06 nvd

HIGH 8.2

DescriptionGitHub Advisory

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.

AnalysisAI

Privilege escalation in Outline (the collaborative wiki/knowledge-base) versions 0.84.0 through 1.6.1 lets a malicious OAuth client smuggle the wildcard '*' scope by requesting a mixed scope string such as 'read *', turning a token the user believes is read-only into one with full write, delete, and admin API access. The flaw is a logic error in OAuthInterface.validateScope(), which uses Array.some() so the whole requested scope set passes validation as long as one element is valid. Publicly available exploit code exists (SSVC: PoC), but there is no evidence of active exploitation and EPSS is very low at 0.03% (8th percentile).