Executive brief
Outline, a collaborative documentation platform, contains a security flaw in how it handles third-party application permissions. An attacker can trick the system into granting full administrative access to an account even when only limited "read-only" access was requested. This allows an unauthorized user to view, modify, or delete all corporate documents, manage users, and change team settings, potentially leading to a total compromise of the organization's documentation and internal knowledge base.
Technical details
A logic error exists in the `OAuthInterface.validateScope()` function within Outline. The function uses the JavaScript `Array.some()` method to validate requested OAuth scopes but incorrectly returns the entire requested scope array if any single scope in the list is valid. An attacker can exploit this by requesting a legitimate scope alongside a wildcard character (e.g., `scope=read *`). Because "read" is valid, the validator returns the full array including the wildcard. Subsequent checks in `AuthenticationHelper.canAccess()` interpret the wildcard as granting unrestricted access to all API endpoints, including write, delete, and administrative operations. The vulnerability is fixed in version 1.7.0.
Affected products
- Outline Outline 0.84.0 to 1.6.1
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published by maintainers
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed in version 1.7.0