Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Description

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last segment. However, it fails to strip the URL fragment (#). Because Koa's router uses ctx.path (which strips the fragment) for routing, an attacker can append a fragment containing a permitted path (e.g., #foo/api/documents.info) to a restricted endpoint (e.g., /api/documents.create). The router will route the request to the restricted endpoint, but canAccess will evaluate the permitted path in the fragment, bypassing the API key scope restrictions and allowing privilege escalation. This vulnerability is fixed in 1.8.0.

Scores

EPSS (exploitation in 30 days)

0.50% · top 57% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-863: Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• outline · outline

  • affected < 1.8.0

References (1)

• https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-54573](https://trackcve.app/badge/CVE-2026-54573.svg)](https://trackcve.app/cve/CVE-2026-54573)

Record last updated 26 Jun 2026, 18:42 UTC.