PT-2026-25904 · Outline · Outline
Published
2026-03-17
·
Updated
2026-03-17
·
CVE-2026-24901
CVSS v3.1
8.1
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Outline