CVE-2026-120449

EUVD-2026-115209
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77
https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
https://github.com/outline/outline/releases/tag/v1.12.0
https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares
https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg