Vulnerabilities

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access.

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status.

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline is a service that allows for collaborative documentation.

Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges.

Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges.

Outline is a service that allows for collaborative documentation.

Outline is an open source, collaborative document editor.

An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie.

An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link.

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.