EUVD-2026-29333Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network API exploitable by any authenticated low-privilege user; high confidentiality impact from arbitrary document exposure; no integrity or availability effect; scope unchanged as impact is confined to Outline's own data.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each-skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.
AnalysisAI
Broken authorization logic across two sequential sharing API calls in Outline collaborative documentation (prior to 1.7.0) allows any authenticated low-privilege user to publish arbitrary documents as publicly accessible shares, exposing content to unauthenticated users without possessing legitimate share rights over the target document. The flaw exploits a permission gap in shares.create (which skips share-permission validation when published=false) combined with a disjunctive OR policy in shares.update that can be satisfied by unrelated collection-level share permissions. No public exploit code repository has been identified in the provided references, though SSVC classifies exploitation evidence at POC level; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.04% (12th percentile), indicating low current real-world exploitation.
Technical ContextAI
Outline is an open-source collaborative knowledge base and documentation platform (CPE: cpe:2.3:a:outline:outline:*:*:*:*:*:*:*:*) whose REST-style API models two resource types - collections and documents - each with independent permission sets including read, write, and share rights. The flaw is classified as CWE-863 (Incorrect Authorization) and manifests across a two-step API workflow: shares.create accepts both collectionId and documentId simultaneously and, when the published flag is false, gates access only on read permission for each resource - omitting the dedicated share-permission check that would normally restrict who may expose a document externally. The second call, shares.update, authorizes publication via a disjunctive policy requiring share permission on the collection OR the document, creating a path where collection-level share rights can satisfy the check for an entirely unrelated document. This architectural OR policy is the proximate root cause, enabling cross-resource privilege escalation within the sharing subsystem.
RemediationAI
Upgrade Outline to version 1.7.0 or later, which corrects the authorization logic in shares.create to enforce share-permission validation regardless of the published flag, and eliminates the exploitable OR-policy gap in shares.update. The authoritative vendor advisory with upgrade guidance is at https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm. If an immediate upgrade is not feasible, a targeted compensating control is to restrict API access to shares.create and shares.update at the reverse-proxy or application-firewall level to only trusted internal IP ranges - this limits external exposure but will break document-sharing functionality for remote users, so the trade-off is significant. Additionally, administrators should audit existing public shares (shares where published=true) to identify any documents made unexpectedly public, and revoke or restrict those shares as needed. Revoking share permissions from all users on all collections is an extreme but effective short-term isolation measure if audit tooling is unavailable.
An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafte
Outline versions up to - contains a vulnerability that allows attackers to potentially execute arbitrary code with eleva
An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and chang
Outline versions prior to 1.4.0 fail to validate attachment file paths during JSON import, allowing authenticated attack
Outline is an open source, collaborative document editor. Rated medium severity (CVSS 5.4), this vulnerability is remote
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1. Rated medium severity (CVSS 5.
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4. Rated medium severity (CVSS 5
Account takeover in Outline collaborative documentation service versions 0.86.0 through 1.5.x enables unauthenticated at
Zip extraction sandbox escape in Outline (self-hosted collaborative knowledge base) before 1.7.0 lets an authenticated u
Privilege escalation in Outline (the collaborative wiki/knowledge-base) versions 0.84.0 through 1.6.1 lets a malicious O
An Insecure Direct Object Reference (IDOR) vulnerability in Outline's document restoration logic allows any authenticate
Broken object-level authorization in Outline (self-hosted collaborative documentation) versions 0.84.0 through 1.7.0 let
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today