Outline EUVD-2026-115209

Exploitation requires that an attacker already holds a valid public share URL (share ID) for a document that was previously published and shared, and that the document has since been unpublished via documents.unpublish - the share loader in shareLoader.ts uses the Document 'withDrafts' scope and never checks publishedAt IS NOT NULL, so the withdrawn document keeps serving. There is NO authentication, cookie, CSRF token, or user interaction required to read the content (PR:N/UI:N confirmed by the vector and by Bob's anonymous requests in the PoC). The limiting factors are significant: the attacker cannot discover or enumerate unpublished documents without an existing link, and only document shares are confirmed affected (collection shares untested). A compounding condition, not a precondition, is that while the document is unpublished shares.revoke returns 404 for both owner and workspace administrator, so the disclosure cannot be closed except by re-publishing then revoking, or by direct database modification. Fixed configurations are any deployment on Outline 1.12.0 or later.

This is a real but bounded confidentiality issue rather than a high-urgency emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated read with LOW confidentiality impact and no integrity or availability impact, scoring 6.9 (Medium). The vuln.today priority is 'this_month', not act_now or emergency, which aligns with the Medium severity and the limited, per-link scope. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is therefore 'no public exploit identified at time of analysis' in the sense of a packaged weaponized exploit, though the VulnCheck/GHSA advisory itself publishes a complete step-by-step reproduction procedure (a public PoC reference exists; it is not verified as standalone working exploit code). The key limiting factor, explicitly stated in the advisory, is that an attacker must already possess a valid public share URL - the flaw does not permit discovery or enumeration of unpublished documents without a link. The practical priority is driven less by exploitation probability and more by the broken-revocation aspect: owners and administrators cannot withdraw exposed content through normal means, turning an accidental over-share into a persistent unauthenticated disclosure. Missing signals: EPSS and KEV are absent (not errors, just not provided), so likelihood is assessed from mechanism rather than observed telemetry.

An Outline user publishes a document, shares it via a public link, then later unpublishes it believing the link is now dead. An attacker (or anyone) who retained that share URL continues to fetch the full withdrawn content unauthenticated via shares.info, documents.info, or the /s/ routes, while the owner's and administrator's attempts to revoke the link fail with 404. The GHSA advisory includes a full reproduction PoC, but exploitation still requires prior possession of the specific share URL.