# CVE-2026-43886: Outline privilege escalation via OAuth scope wildcard smuggling

Source: https://junglewise.ai/threats/cve-2026-43886-outline-privilege-escalation-via-oauth-scope-wildcard-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-43886 · Severity: high · CVSS 8.2 · Published 2026-05-11

Outline, a collaborative documentation platform, contains a security flaw in how it handles third-party application permissions. An attacker can trick the system into granting full administrative access to an account even when only limited "read-only" access was requested. This allows an unauthorized user to view, modify, or delete all corporate documents, manage users, and change team settings, potentially leading to a total compromise of the organization's documentation and internal knowledge base.

## Quick answers

**Is CVE-2026-43886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43886 being exploited in the wild.

**How severe is CVE-2026-43886?** High severity, with a CVSS score of 8.2, published 11 May 2026.

**Which products and versions are affected?** Outline Outline 0.84.0 to 1.6.1.

**Is there a fix for CVE-2026-43886?** A patch was published on 2026-05-11: Fix confirmed in version 1.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43886 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43886?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic error exists in the `OAuthInterface.validateScope()` function within Outline. The function uses the JavaScript `Array.some()` method to validate requested OAuth scopes but incorrectly returns the entire requested scope array if any single scope in the list is valid. An attacker can exploit this by requesting a legitimate scope alongside a wildcard character (e.g., `scope=read *`). Because "read" is valid, the validator returns the full array including the wildcard. Subsequent checks in `AuthenticationHelper.canAccess()` interpret the wildcard as granting unrestricted access to all API endpoints, including write, delete, and administrative operations. The vulnerability is fixed in version 1.7.0.

## Affected products

- Outline Outline 0.84.0 to 1.6.1

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory published by maintainers
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed in version 1.7.0

## References

- [https://github.com/outline/outline/security/advisories/GHSA-7732-6qrg-wjf4](https://github.com/outline/outline/security/advisories/GHSA-7732-6qrg-wjf4)