Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck
CVE-2026-120449Outline before 1.12.0 Improper Access Control via Public Document Shares
Medium 5.3
In plain English
A medium-severity security flaw in Outline from Outline. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
Affected products (as reported)
Weakness: CWE-672 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-rq53-m97j-f2pg) vendor-advisory
- https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52 patch
- Outline v1.12.0 Release Notes release-notes
- https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77 technical-description
- VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via Public Document Shares third-party-advisory