Read the docs

outline

Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

outline records in CISA KEV

No outline vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

25 records

Priority HIGH 72

Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00151 Published 2026-01-30 No fix listed CWE-428
Priority HIGH 70

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00443 Published 2026-11-02 Fixed in 1.12.0 CWE-672
Priority HIGH 67

Outline is a service that allows for collaborative documentation.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00205 Published 2026-05-11 Fixed in 1.7.1 CWE-639
Priority HIGH 67

Outline is a service that allows for collaborative documentation.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00245 Published 2026-05-11 Fixed in 1.7.0 CWE-79
Priority MEDIUM 64

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00535 Published 2026-10-20 Fixed in 1.8.0 CWE-863
Priority MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00495 Published 2023-07-07 Fixed in 0.70.1 CWE-79
TI-2023-30605 CVE-2023-54331 · GHSA-368x-rx64-j3wc

Outline 1.6.0 - Unquoted Service Path

Priority LOW 38

Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00228 Published 2026-01-13 No fix listed CWE-428
Priority LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.007 Published 2022-07-07 Fixed in v0.64.4 CWE-79
Priority LOW 24

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00245 Published 2026-11-02 Fixed in 1.12.0 CWE-863
Open these records in search →