Incorrect Authorization Flaw in Outline by Outline

CVE-2026-120489

What is CVE-2026-120489?

An incorrect authorization vulnerability exists in Outline versions prior to 1.12.0, specifically within the authorizeDocumentPublish() function. This flaw allows authenticated users to publish documents within private collections without having the necessary write access. Attackers can exploit this vulnerability by detaching a child document using the documents.unpublish command, while still keeping the parentDocumentId intact. They can then invoke documents.update with a UUID from a private collection, leading to the injection of malicious or phishing content into private documents.

References