Insecure Direct Object Reference in Outline Service Allows Unauthorized Document Access

CVE-2026-41649

What is CVE-2026-41649?

Outline, a collaborative documentation service, has been identified with an insecure direct object reference vulnerability in the shares.create API endpoint. This issue, present in versions 0.86.0 through 1.6.9, allows an authenticated attacker to generate valid public share links for documents belonging to other workspaces without proper authorization checks. Specifically, the vulnerability arises when both collectionId and documentId are included in the request. The system's authorization logic only verifies access to the collection, failing to check permissions against the specific document, thus exposing sensitive document content through the documents.info endpoint. The issue has been addressed in version 1.7.0.

References