CVE-2026-41649 PUBLISHED

Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces

Assigner: GitHub_M
Reserved: 21.04.2026 Published: 28.04.2026 Updated: 28.04.2026

Outline is a service that allows for collaborative documentation. The shares.create API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both collectionId and documentId are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the documents.info endpoint. Version 1.7.0 contains a patch.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Product Status

Vendor outline
Product outline
Versions
  • Version >= 0.86.0, < 1.7.0 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE