Improper Access Control in Outline by GetOutline
CVE-2026-120449

6.9MEDIUM

Key Information:

Vendor

Outline

Status
Outline
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120449?

Outline versions prior to 1.12.0 are susceptible to an improper access control vulnerability, which allows unauthorized users to access unpublished documents. This occurs because the share loader fails to recognize the unpublished status of documents. Attackers with existing share links can exploit this flaw to query share details and access sensitive withdrawn content through shares.info and documents.info endpoints. Furthermore, attempts to revoke these shares result in a 404 error, effectively preventing users from securing their documents.

Affected Version(s)

Outline 0 < 1.12.0

References

https://github.com/outline/outline/security/advisories/GH...
vendor-advisory
https://github.com/outline/outline/commit/d015a32459b5f5c...
patch
https://github.com/outline/outline/releases/tag/v1.12.0
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VG
.