EUVD-2026-39466Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; PR:L because a valid API key is required; integrity impact is Low as unauthorized writes are possible but scoped within the application; no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last segment. However, it fails to strip the URL fragment (#). Because Koa's router uses ctx.path (which strips the fragment) for routing, an attacker can append a fragment containing a permitted path (e.g., #foo/api/documents.info) to a restricted endpoint (e.g., /api/documents.create). The router will route the request to the restricted endpoint, but canAccess will evaluate the permitted path in the fragment, bypassing the API key scope restrictions and allowing privilege escalation. This vulnerability is fixed in 1.8.0.
AnalysisAI
API key scope bypass in Outline prior to 1.8.0 allows an authenticated attacker holding a limited-scope API key or OAuth token to perform actions on restricted endpoints by exploiting a URL fragment handling discrepancy. The AuthenticationHelper.canAccess function evaluates authorization against the fragment-appended URL path rather than the actual routed endpoint, enabling privilege escalation beyond the key's intended permissions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (PR:L, AC:L) makes this straightforward to exploit for any valid API key holder.
Technical ContextAI
Outline is an open-source collaborative documentation platform built on the Koa Node.js web framework. The root cause (CWE-863: Incorrect Authorization) lies in a path-parsing inconsistency within AuthenticationHelper.canAccess: it uses ctx.originalUrl to extract the resource being accessed by splitting on / and taking the last segment, but critically does not strip the URL fragment component (#...). Koa's router, however, dispatches requests using ctx.path, which the framework normalizes by stripping fragments - a standard HTTP behavior since fragments are client-side constructs never sent to the server in standard requests (though they can appear in raw URLs). This split-brain view of the URL means the authorization layer and the routing layer evaluate two different paths for the same request. Affected products are identified via CPE cpe:2.3:a:outline:outline:*:*:*:*:*:*:*:*, covering all versions prior to 1.8.0.
RemediationAI
Vendor-released patch: Outline 1.8.0. Upgrade to 1.8.0 or later immediately; this is the only confirmed fix per the GitHub Security Advisory GHSA-5x79-rj4g-qrh8 at https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8. If immediate upgrade is not possible, a compensating control is to revoke or rotate all API keys and OAuth tokens that have been issued with restricted scopes, and temporarily replace them with keys that either have full permissions (removing the false sense of scope security) or no access at all until the patch is applied. Network-layer controls cannot mitigate this vulnerability since the exploit is embedded in a legitimately authenticated request. There is no known configuration flag or feature toggle to disable the vulnerable code path without upgrading.
An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafte
Outline versions up to - contains a vulnerability that allows attackers to potentially execute arbitrary code with eleva
An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and chang
Outline versions prior to 1.4.0 fail to validate attachment file paths during JSON import, allowing authenticated attack
Outline is an open source, collaborative document editor. Rated medium severity (CVSS 5.4), this vulnerability is remote
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1. Rated medium severity (CVSS 5.
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4. Rated medium severity (CVSS 5
Account takeover in Outline collaborative documentation service versions 0.86.0 through 1.5.x enables unauthenticated at
Zip extraction sandbox escape in Outline (self-hosted collaborative knowledge base) before 1.7.0 lets an authenticated u
Privilege escalation in Outline (the collaborative wiki/knowledge-base) versions 0.84.0 through 1.6.1 lets a malicious O
An Insecure Direct Object Reference (IDOR) vulnerability in Outline's document restoration logic allows any authenticate
Broken object-level authorization in Outline (self-hosted collaborative documentation) versions 0.84.0 through 1.7.0 let
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today