Executive brief
Outline, a collaborative documentation platform, contains a security flaw in its subscription system. An authenticated user can bypass security checks to subscribe to documents they do not have permission to view, including documents belonging to other organizations on the same server. This allows an attacker to receive notifications about document updates, potentially leaking sensitive document titles, the identities of people editing them, and the frequency of changes.
Technical details
A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the `subscriptions.create` API endpoint due to inconsistent validation logic between the route handler and the database command. When a request provides both a `collectionId` and a `documentId`, the route handler validates only the `collectionId`. However, the downstream `subscriptionCreator` command prioritizes the `documentId` when writing to the database. Because the schema does not enforce mutual exclusivity between these two fields, an attacker can provide a `collectionId` they own to pass authorization while supplying a victim's `documentId` to create a cross-tenant subscription. This allows the attacker to receive notification side-effects and confirm the existence of documents across different teams. The issue is fixed in version 1.7.1.
Affected products
- Outline Outline 0.82.1 to 1.7.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory GHSA-gf8h-cv9v-q4fw published
- 2026-05-11: disclosed: CVE-2026-43890 published to NVD
- 2026-05-11: patched: Vulnerability fixed in version 1.7.1