CVE-2026-41649

HIGH EPSS 21.0%
Published Apr 28, 20262mo ago · Modified Jun 17, 20261w ago
7.7 CVSS 3.1
High
Find Similar
Published Apr 28, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.

CVSS Details

Base Score
7.7
Exploitability
3.1
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
21.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-639

Affected Products 1

VendorProductVersionRange
getoutlineoutline*≥0.86.0  –  <1.7.0

References 3

  • github.com https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460
    Patch
  • github.com https://github.com/outline/outline/releases/tag/v1.7.0
    Release Notes
  • github.com https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460
    Patch