outline vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20241
4. 20251
5. 202617

Newest CVEs

• CVE-2026-120489

  Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

  Outline · Outline

  Medium5.3
• CVE-2026-120449

  Outline before 1.12.0 Improper Access Control via Public Document Shares

  Outline · Outline

  Medium6.9
• CVE-2026-113611

  Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

  outline · outline

  Medium6.9
• CVE-2026-54573

  Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

  outline · outline

  Medium5.3
• CVE-2026-44695

  Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity

  outline · outline

  Medium5.8
• CVE-2026-43889

  Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share

  outline · outline

  Medium6.5
• CVE-2026-43888

  Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import

  outline · outline

  High8.7
• CVE-2026-43890

  Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

  outline · outline

  High7.7
• CVE-2026-43886

  Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access

  outline · outline

  High8.2
• CVE-2026-43887

  Outline: Stored XSS via Comment Mentions

  outline · outline

  High7.3