Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113611Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Medium 4.9

In plain English

A medium-severity incorrect authorization in outline from outline. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

Affected products (as reported)

Vendor	Product	Versions
outline	outline	0 – before 1.8.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-33jq-x32c-3ccw) vendor-advisory
https://github.com/outline/outline/commit/e044014cea958962fc9f5e2b8f6ff1d8cadd676f patch
outline v1.8.0 Release Notes release-notes
https://github.com/outline/outline/blob/v1.7.1/server/queues/processors/UserDeletedProcessor.ts technical-description
VulnCheck Advisory: Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions third-party-advisory