Outline EUVD-2026-115224

Requires a valid authenticated session as any ordinary workspace member (PR:L) - read-only or no-access members suffice; the attacker must know the target private collection's UUID and must possess at least one writable collection in which to create a parent document. The attack path specifically requires chaining documents.unpublish with detach:true (to null the collectionId while retaining parentDocumentId) followed by documents.update with publish:true pointing at the private collection UUID; a detached document WITHOUT a retained parentDocumentId is correctly rejected with 403, so the retained parent link is the precise enabling condition. Limiting factors: affects only Outline versions before 1.12.0, grants integrity/content-injection only (no read access to the private collection is obtained), and requires prior authentication plus knowledge of the collection identifier.

This is a genuine but moderate-severity integrity issue, correctly rated in the medium range (input CVSS 4.0 base 5.3). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is internally consistent with the advisory: network-reachable, low attack complexity, and crucially PR:L - an authenticated workspace member is required, so this is NOT an unauthenticated flaw. Impact is confined to integrity (VI:L); the reporter explicitly confirmed NO confidentiality impact (the attacker still cannot read the private collection or re-open the injected document), which aligns with VC:N. No EPSS score and no KEV status were provided, so there is no signal of active exploitation - exploitation status is 'no public exploit identified' in the strict sense, though a detailed step-by-step PoC (exact HTTP request sequence) is published in the GHSA advisory. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with an authenticated, integrity-only content-injection bug rather than a critical RCE. Net: a real, confirmed authorization defect worth patching on a normal cycle, not a drop-everything emergency, limited by the authentication requirement and the need to know the target collection UUID.

An authenticated but low-privileged Outline workspace member who knows the UUID of a private collection they cannot access creates a parent/child document pair in their own writable collection, detaches the child via documents.unpublish (retaining parentDocumentId), then calls documents.update with the private collection UUID and publish:true to inject attacker-controlled content - e.g. phishing links or fake policy documents - into the confidential collection. A full working proof-of-concept with the exact request sequence is published in the vendor GHSA advisory, so exploitation requires no novel research.