Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Outline 1.12.0 Clear all filters
TI-2026-83856 CVE-2026-120489 · GHSA-vf3p-f5rx-9848

Incorrect authorization in Outline lets members publish into private collections

Priority LOW 24

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00245 Published 2026-11-02 Fixed in 1.12.0 CWE-863
TI-2026-83841 CVE-2026-120449 · GHSA-4q4r-qmm8-wr2p

Outline exposes unpublished documents through public share links

Priority HIGH 70

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00443 Published 2026-11-02 Fixed in 1.12.0 CWE-672