PT-2026-25904 · Outline · Outline

Nlgbao1340 · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-24901

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.4.0

Description Outline is a collaborative documentation service. A security issue exists in the document restoration logic that allows any team member to restore, view, and take ownership of deleted drafts belonging to other users, including administrators, without authorization. This is due to a bypass of ownership validation during the restoration process, potentially allowing an attacker to access sensitive private information and prevent the original owner from accessing their content. The issue does not affect versions 1.4.0 and later.

Recommendations Versions prior to 1.4.0 should be updated to version 1.4.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-24901

GHSA-GMR5-43F5-79F5

Produtos afetados

Outline

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24901.json · Exploit
• https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2033953728089239822 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2033955860007837951 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24901 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2034012399469228075 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24901 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033994272337490152 · Publicação no Twitter