Is CVE-2026-120489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120489 being exploited in the wild.

How severe is CVE-2026-120489?

Medium severity, with a CVSS score of 4.3, published 2 November 2026.

Is there a fix for CVE-2026-120489?

Yes: fixed in 1.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120489 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-120489?

Check whether you run Outline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120489: Outline incorrect authorization in document publishing

CVE-2026-120489 · Severity: medium · CVSS 4.3 · Published 2026-11-02

Outline is a collaborative wiki and documentation platform. An authorization flaw in the document publishing mechanism allows authenticated users to publish phishing or malicious content into private collections they should not have write access to by exploiting incomplete permission checks during the document update process.

Technologies: Outline. Vendors: Outline.

Quick answers

Is CVE-2026-120489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120489 being exploited in the wild.
How severe is CVE-2026-120489?: Medium severity, with a CVSS score of 4.3, published 2 November 2026.
Which products and versions are affected?: Outline before 1.12.0.
Is there a fix for CVE-2026-120489?: Yes: fixed in 1.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120489 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-120489?: Check whether you run Outline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.12.0

Technical details

The authorizeDocumentPublish() function in Outline before 1.12.0 fails to properly validate write permissions when moving documents between collections. An authenticated attacker can unpublish a child document to detach it while retaining its parentDocumentId, then call documents.update with a private collection UUID to inject the document into a restricted collection without authorization.

Affected products

Outline Outline before 1.12.0

Timeline

2026-11-02: disclosed
2026-10-19: patched: Fix committed but advisory published later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.