PT-2026-35821 · Outline · Outline

Ayboraa · Published 2026-04-28 · Updated 2026-05-01 · CVE-2026-41649

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Outline versions 0.86.0 through 1.6.9

Description An insecure direct object reference exists in the 'shares.create' API endpoint. When both collectionId and documentId are provided in a request, the authorization logic verifies access to the collection but ignores the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including those from other workspaces. The full contents of the document can subsequently be retrieved via the 'documents.info' endpoint.

Recommendations Update to version 1.7.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41649

Affected Products

Outline

References · 7

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7 · Exploit
• https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff460 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41649 · Security Note
• https://github.com/outline/outline/releases/tag/v1.7.0 · Note
• https://t.me/cveNotify/161771 · Telegram Post
• https://t.me/cveNotify/161586 · Telegram Post
• https://twitter.com/ulwsie/status/2049284051727454633 · Twitter Post