Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120489Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Medium 4.3

In plain English

A medium-severity incorrect authorization in Outline from Outline. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

Affected products (as reported)

Vendor	Product	Versions
Outline	Outline	0 – before 1.12.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-h6ff-rw9x-5mq2) vendor-advisory
https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc patch
Outline v1.12.0 Release Notes release-notes
https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143 technical-description
VulnCheck Advisory: Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft third-party-advisory