Medium severity5.3NVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026
CVE-2026-120449
CVE-2026-120449
Description
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.tsnvd
- github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52nvd
- github.com/outline/outline/releases/tag/v1.12.0nvd
- github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pgnvd
- www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-sharesnvd
News mentions
0No linked articles in our index yet.