Executive brief
Outline, a collaborative documentation platform, contains a vulnerability that allows authenticated users to bypass sharing restrictions. An attacker with permission to share one document or collection can exploit a logic flaw to publicly expose a different, unrelated document they are not authorized to share. This could lead to the unauthorized public disclosure of sensitive internal documentation to unauthenticated users.
Technical details
An authorization bypass exists in Outline's sharing API due to inconsistent permission checks between the creation and update phases of a share. The 'shares.create' endpoint fails to enforce mutual exclusivity between 'collectionId' and 'documentId' and skips 'share' permission checks if the 'published' flag is false. An attacker can create a draft share linking a target document (which they can only read) to an unrelated collection (which they have permission to share). When calling 'shares.update' to publish the share, the system uses an 'OR' logic policy that grants the update if the user has share permissions on either the document or the collection. Finally, the 'loadPublicShare' command fails to verify that the requested document actually belongs to the associated collection, allowing unauthenticated public access to the document via the share URL. This is fixed in version 1.7.0.
Affected products
- Outline Outline < 1.7.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD