CVE-2026-120449

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77
https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
https://github.com/outline/outline/releases/tag/v1.12.0
https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares
https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg

Configurations

No configuration.

History

02 Nov 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg -~~	() https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg -

02 Nov 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-11-02 15:17

Updated : 2026-11-02 19:34

NVD link : CVE-2026-120449

Mitre link : CVE-2026-120449

CVE.ORG link : CVE-2026-120449

JSON object : View

Products Affected

No product.

CWE

CWE-672

Operation on a Resource after Expiration or Release

{"id": "CVE-2026-120449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120449", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:42:37.475888Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/outline/outline", "vendor": "Outline", "product": "Outline", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.0", "versionType": "semver"}], "packageURL": "pkg:github/outline/outline", "defaultStatus": "unaffected"}]}], "published": "2026-11-02T15:17:27.937", "references": [{"url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/outline/outline/releases/tag/v1.12.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."}], "lastModified": "2026-11-02T19:34:23.993", "sourceIdentifier": "disclosure@vulncheck.com"}