PT-2026-39857 · Outline · Outline

Bugbunny-Research · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43889

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.7.0

Description The 'shares.create' API accepts both collectionId and documentId simultaneously. When published is set to false, the system only verifies read access for each, skipping the required share permission check. A subsequent 'shares.update' call authorizes publication using an OR policy, meaning the user only needs share permissions for either the collection or the document. This allows an attacker with share permissions on an unrelated collection to publish a share that exposes an arbitrary document they are not authorized to share, making it accessible to unauthenticated users.

Recommendations Update to version 1.7.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-43889

Affected Products

Outline

References · 4

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-rg4j-pmch-w6pm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43889 · Security Note
• https://t.me/CVEtracker/53420 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053997549925667220 · Twitter Post