# CVE-2026-54573: Outline authorization bypass via path parsing discrepancy

Source: https://junglewise.ai/threats/cve-2026-54573-outline-authorization-bypass-via-path-parsing-discrepancy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54573 · Severity: info · CVSS 5.3 · Published 2026-06-25

Outline, a collaborative documentation platform, contains a security flaw in how it validates API permissions. An attacker with limited access (such as a read-only API key) can bypass security restrictions to perform unauthorized actions, like creating or modifying documents. This could lead to unauthorized data changes or privilege escalation within the workspace.

## Quick answers

**Is CVE-2026-54573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54573 being exploited in the wild.

**How severe is CVE-2026-54573?** Informational severity, with a CVSS score of 5.3, published 25 June 2026.

**Which products and versions are affected?** Outline Outline < 1.8.0.

**Is there a fix for CVE-2026-54573?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54573 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54573?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in Outline's AuthenticationHelper.canAccess function due to a discrepancy in how URLs are parsed compared to the Koa router. The function uses ctx.originalUrl to validate API key scopes by splitting the string at slashes and checking the last segment, but it fails to strip URL fragments (#). While the Koa router uses ctx.path (which excludes fragments) to direct the request to a restricted endpoint, the authorization check processes the full URL including the fragment. By appending a fragment containing a permitted resource name to a restricted path, an attacker with a low-privileged API key can trick the system into granting access to restricted endpoints. This allows for privilege escalation, such as using a read-only key to perform write operations. The issue is resolved in version 1.8.0.

## Affected products

- Outline Outline < 1.8.0

## Timeline

- 2026-06-15: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD

## References

- [https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8](https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8)