Outline EUVD-2026-39466

The attacker must possess a valid but limited-scope API key or OAuth token for the target Outline instance (PR:L). The exploit requires that the instance enforces API key scope restrictions, which is the standard Outline API key model. The attacker appends a URL fragment containing a path component that their key IS permitted to access (e.g., #foo/api/documents.info) to a restricted endpoint URL (e.g., /api/documents.create). No special server configuration, non-default settings, or additional privileges beyond key possession are required. Exploitation is limited to the set of restricted endpoints where a corresponding permitted path can be embedded in the fragment - it does not grant arbitrary unauthenticated access, and an attacker with no API key at all cannot exploit this flaw.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L reflects a real but bounded risk: the attack is network-reachable with low complexity and requires only a valid API key (PR:L), but the integrity impact is rated Low (VI:L) and there is no confidentiality or availability dimension. In practice, the risk is most significant in multi-tenant deployments or integrations where third-party API keys are issued with intentionally restricted scopes - in those cases, the restriction is entirely circumvented. There is no CISA KEV listing and no public proof-of-concept identified, keeping the exploitation probability low in terms of widespread automated scanning. However, the technique is conceptually simple and reproducible by anyone who can read the advisory, meaning motivated actors with existing API key access could trivially exploit it. The low AC and no-UI-required conditions mean there is no meaningful barrier once an API key is obtained. The missing signal here is EPSS score, which is not provided - without it, probabilistic exploitation risk cannot be quantified. Overall, organizations relying on API key scope restrictions as a security boundary should treat this as high priority despite the moderate CVSS score.

An attacker is issued a read-only API key scoped to documents.info for an Outline integration. They craft a request to the restricted endpoint /api/documents.create#foo/api/documents.info with their read-only API key. Koa routes the request to /api/documents.create based on ctx.path, but canAccess extracts documents.info from the fragment as the resource being accessed, determines the key has permission, and allows the request - resulting in unauthorized document creation.