# CVE-2026-43890: Outline IDOR in subscriptions.create API endpoint

Source: https://junglewise.ai/threats/cve-2026-43890-outline-idor-in-subscriptions-create-api-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-43890 · Severity: high · CVSS 7.7 · Published 2026-05-11

Outline, a collaborative documentation platform, contains a security flaw in its subscription system. An authenticated user can bypass security checks to subscribe to documents they do not have permission to view, including documents belonging to other organizations on the same server. This allows an attacker to receive notifications about document updates, potentially leaking sensitive document titles, the identities of people editing them, and the frequency of changes.

## Quick answers

**Is CVE-2026-43890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43890 being exploited in the wild.

**How severe is CVE-2026-43890?** High severity, with a CVSS score of 7.7, published 11 May 2026.

**Which products and versions are affected?** Outline Outline 0.82.1 to 1.7.0.

**Is there a fix for CVE-2026-43890?** A patch was published on 2026-05-11: Vulnerability fixed in version 1.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43890 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43890?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the `subscriptions.create` API endpoint due to inconsistent validation logic between the route handler and the database command. When a request provides both a `collectionId` and a `documentId`, the route handler validates only the `collectionId`. However, the downstream `subscriptionCreator` command prioritizes the `documentId` when writing to the database. Because the schema does not enforce mutual exclusivity between these two fields, an attacker can provide a `collectionId` they own to pass authorization while supplying a victim's `documentId` to create a cross-tenant subscription. This allows the attacker to receive notification side-effects and confirm the existence of documents across different teams. The issue is fixed in version 1.7.1.

## Affected products

- Outline Outline 0.82.1 to 1.7.0

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory GHSA-gf8h-cv9v-q4fw published
- 2026-05-11: disclosed: CVE-2026-43890 published to NVD
- 2026-05-11: patched: Vulnerability fixed in version 1.7.1

## References

- [https://github.com/outline/outline/security/advisories/GHSA-gf8h-cv9v-q4fw](https://github.com/outline/outline/security/advisories/GHSA-gf8h-cv9v-q4fw)