Description
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
Affected products
getoutline: outline
References4
- github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w… ExploitVendor Advisory
- github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w… ExploitVendor Advisory
- github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773… Patch
- github.com/outline/outline/releases/tag/v1.7.0 Release Notes
Metrics
- CVSS 3.1
-
7.7
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 22 · as of 13 November 2026
- CWE
- CWE-639
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.