CVE-2026-43889
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/05/2026
Last modified:
12/05/2026
Description
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM