Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-43886Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access

High 8.2

In plain English

A high-severity privilege mismanagement in outline from outline. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 88.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.

Affected products (as reported)

Vendor	Product	Versions
outline	outline	>= 0.84.0, < 1.7.0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

References

https://github.com/outline/outline/security/advisories/GHSA-7732-6qrg-wjf4 x_refsource_CONFIRM