PT-2026-39858 · Outline · Outline

Matte1782 · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43890

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Outline versions 0.84.0 through 1.7.0

Description The 'subscriptions.create' API endpoint in 'server/routes/api/subscriptions/subscriptions.ts' contains a broken authorization pattern. When both collectionId and documentId are provided in a request, the system only validates authorization for the collection branch. However, the subscriptionCreator() function in 'server/commands/subscriptionCreator.ts' creates the subscription using the documentId, which remains unvalidated. Because the schema in 'server/routes/api/subscriptions/schema.ts' allows both parameters to be sent simultaneously, an attacker can create a subscription to a document they do not have read access to on any team within the instance.

Recommendations Update to version 1.7.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-43890

Affected Products

Outline

References · 4

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-gf8h-cv9v-q4fw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43890 · Security Note
• https://twitter.com/VulmonFeeds/status/2053994990154534914 · Twitter Post
• https://t.me/CVEtracker/53421 · Telegram Post