# CVE-2026-43889: Outline incorrect authorization in shares.create API

Source: https://junglewise.ai/threats/cve-2026-43889-outline-incorrect-authorization-in-shares-create-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-43889 · Severity: medium · CVSS 6.5 · Published 2026-05-11

Outline, a collaborative documentation platform, contains a vulnerability that allows authenticated users to bypass sharing restrictions. An attacker with permission to share one document or collection can exploit a logic flaw to publicly expose a different, unrelated document they are not authorized to share. This could lead to the unauthorized public disclosure of sensitive internal documentation to unauthenticated users.

Technologies: [Jigsaw Outline](https://junglewise.ai/threats/technologies/outline). Vendors: [Jigsaw](https://junglewise.ai/threats/vendors/jigsaw).

## Quick answers

**Is CVE-2026-43889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43889 being exploited in the wild.

**How severe is CVE-2026-43889?** Medium severity, with a CVSS score of 6.5, published 11 May 2026.

**Which products and versions are affected?** Jigsaw Outline < 1.7.0.

**Is there a fix for CVE-2026-43889?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-43889 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-43889?** Check whether you run Jigsaw Outline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in Outline's sharing API due to inconsistent permission checks between the creation and update phases of a share. The 'shares.create' endpoint fails to enforce mutual exclusivity between 'collectionId' and 'documentId' and skips 'share' permission checks if the 'published' flag is false. An attacker can create a draft share linking a target document (which they can only read) to an unrelated collection (which they have permission to share). When calling 'shares.update' to publish the share, the system uses an 'OR' logic policy that grants the update if the user has share permissions on either the document or the collection. Finally, the 'loadPublicShare' command fails to verify that the requested document actually belongs to the associated collection, allowing unauthenticated public access to the document via the share URL. This is fixed in version 1.7.0.

## Affected products

- Outline Outline < 1.7.0

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD

## References

- [https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm](https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm)

## Related threats

- [Outline account linking bypass in Slack integration callback](https://junglewise.ai/threats/cve-2026-44695-outline-account-linking-bypass-in-slack-integration-callback)
- [Outline path traversal via path length truncation in ZipHelper](https://junglewise.ai/threats/cve-2026-43888-outline-path-traversal-via-path-length-truncation-in-ziphelper)
- [Outline IDOR in shares.create API allows cross-workspace document access](https://junglewise.ai/threats/cve-2026-41649-outline-idor-in-shares-create-api-allows-cross-workspace-document)