PT-2026-25904 · Outline · Outline

Nlgbao1340 · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-24901

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.4.0

Description Outline is a collaborative documentation service. A security issue exists in the document restoration logic that allows any team member to restore, view, and take ownership of deleted drafts belonging to other users, including administrators, without authorization. This is due to a bypass of ownership validation during the restoration process, potentially allowing an attacker to access sensitive private information and prevent the original owner from accessing their content. The issue does not affect versions 1.4.0 and later.

Recommendations Versions prior to 1.4.0 should be updated to version 1.4.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-24901

GHSA-GMR5-43F5-79F5

Affected Products

Outline

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24901.json · Exploit
• https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24901 · Security Note
• https://twitter.com/cyberbivash/status/2033953728089239822 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033955860007837951 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034012399469228075 · Twitter Post
• https://twitter.com/CVEnew/status/2033994272337490152 · Twitter Post