Improper Access Revocation in Outline by GetOutline
CVE-2026-113611

6.9MEDIUM

Key Information:

Vendor

Outline

Status
Outline
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113611?

Outline prior to version 1.8.0 contains an improper access revocation vulnerability. When an administrator is deleted, their webhook subscriptions remain active, allowing them to continue receiving document content, including sensitive data through DeliverWebhookTask. This issue arises due to the UserDeletedProcessor not disabling the webhook subscription for deleted users, leading to potential information disclosure. Users should ensure they upgrade to version 1.8.0 or later to mitigate this risk. For further details, refer to the GitHub Security Advisory.

Affected Version(s)

outline 0 < 1.8.0

References

https://github.com/outline/outline/security/advisories/GH...
vendor-advisory
https://github.com/outline/outline/commit/e044014cea95896...
patch
https://github.com/outline/outline/releases/tag/v1.8.0
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanjorn Keeratirungsan (dizconnectz)
.