What’s Vulnerable › Vulnerabilities

CVE-2026-41649: Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-28 · updated 2026-07-24
• Weakness: CWE-639

Description

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.

Affected products

• outline: from 0.86.0 before 1.7.0 — fixed in 1.7.0

How to fix

Upgrade to a fixed version: outline 1.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460
• https://github.com/outline/outline/releases/tag/v1.7.0
• https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7
• https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7

Get alerted when CVE-2026-41649 or the next vulnerability affects your stack