Executive brief
Outline, a collaborative documentation platform, contains a security flaw that allows users to access private documents they are not authorized to see. By manipulating a specific sharing feature, an authenticated user can generate public links for any document on the system, including those belonging to different organizations or workspaces. This could lead to the exposure of sensitive internal documents, unpublished drafts, and confidential business information.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `shares.create` API endpoint of Outline. The vulnerability is rooted in `server/routes/api/shares/shares.ts`, where a ternary operator in the authorization logic only validates the `collectionId` if both a collection and a `documentId` are provided, effectively skipping the authorization check for the document itself. An authenticated attacker can provide a `collectionId` they own alongside a target `documentId` they do not have access to. The system then generates a valid public share link for the unauthorized document. The attacker can subsequently use the `documents.info` endpoint with the generated share ID to retrieve the full contents of the document, including those in separate workspaces (cross-tenant access). This issue is resolved in version 1.7.0.
Affected products
- Outline Outline >= 0.86.0, < 1.7.0
Timeline
- 2026-04-24: patched: Version 1.7.0 released
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-04-28: disclosed: CVE published to NVD