CVE-2026-43889 Details
Description
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.
A vulnerability in the Outline collaborative documentation service prior to version 1.7.0 allows unauthorized publication of documents. The shares.create API could accept both collectionId and documentId at the same time. When published=false, it only checked read access for each, ignoring the 'share' permission. This oversight allowed an attacker with share permission on one collection to publish a share that exposed a document from another collection, bypassing authorization controls and making the document accessible to unauthenticated users. The vulnerability is fixed in version 1.7.0.
Users are advised to update to Outline version 1.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Outline | < 1.7.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |