CVE-2026-41649 Details
Description
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
A vulnerability allowing unauthorized access to private documents across workspaces has been identified in the Outline application. This issue arises from an insecure direct object reference (IDOR) in the 'shares.create' API endpoint, present in Outline versions 0.86.0 through 1.7.0. The vulnerability allows an authenticated attacker to generate public share links for any document, including those in other workspaces, by exploiting a flaw in the authorization logic, which only verifies access to collections and not individual documents. As a result, attackers can access private documents they do not have membership to, unpublished drafts, and even documents from entirely separate organizations on the same Outline instance.
Users can update to Outline version 1.7.0, which includes a patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460 | [email protected] | Patch |
| https://github.com/outline/outline/releases/tag/v1.7.0 | [email protected] | Release Notes |
| https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getoutline outline | >= 0.86.0, < 1.7.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | New CVE Received | [email protected] |