CVE-2026-113611 in Outline
Summary
by MITRE • 10/20/2026
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Outline versions prior to 1.8.0 represents a critical failure in access control revocation mechanisms within the application's webhook infrastructure. This flaw specifically affects former administrators who had previously registered webhooks before their administrative privileges were revoked or their accounts were deleted. Under normal operational security expectations, when an administrator is removed from a workspace or their account is deleted, all associated permissions and automated integrations should be immediately terminated to prevent unauthorized data exposure. However, the implementation of the UserDeletedProcessor component fails to disable or remove WebhookSubscription rows linked to these users. This oversight creates a persistent state where the system continues to treat these former admins as active webhook subscribers despite their lack of valid authorization status.
From a technical perspective, the core issue lies in the asynchronous processing logic that handles user deletion events. When an administrator is deleted, the UserDeletedProcessor executes tasks intended to clean up associated resources but neglects to iterate through and invalidate existing WebhookSubscription records. Consequently, these subscription entries remain active in the database with their enabled flags set to true. The DeliverWebhookTask component, which is responsible for dispatching webhook payloads based on workspace events such as document updates or creations, does not perform a secondary validation check against the current user status of the subscriber before sending data. This architectural gap allows the system to blindly deliver sensitive information to endpoints associated with deleted accounts without verifying if those accounts still possess valid access rights within the platform.
The operational impact of this vulnerability is significant, particularly regarding confidentiality and data integrity. Former administrators continue to receive full document bodies via webhook deliveries for every matching event in their former workspaces. This includes not only standard Markdown content but also Yjs collaborative editing data, which contains detailed information about real-time edits, cursor positions, and potentially sensitive changes made by other users. Since webhooks are typically configured with external URLs that may be monitored or controlled by third parties, this continuous stream of data effectively bypasses the intended access controls. An attacker who had previously gained administrative access could delete their account to evade detection while maintaining a persistent backdoor for exfiltrating ongoing document contents and collaborative metadata indefinitely.
This vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in revoking permissions upon user state changes such as deletion or role removal. It also maps to MITRE ATT&CK technique T1530 Data from Cloud Storage Object Misconfiguration, where data is exposed due to improper configuration of access controls within a cloud-based service. The persistence of the webhook subscriptions effectively creates an unauthorized information channel that persists beyond the intended lifecycle of the user account.
To mitigate this risk, organizations running Outline versions prior to 1.8.0 should upgrade immediately to version 1.8.0 or later where these issues have been addressed. For environments unable to patch instantly, manual intervention is required by querying the database for WebhookSubscription records associated with deleted users and disabling them manually. Additionally, implementing a robust audit trail for webhook subscription changes can help detect such anomalies earlier in future deployments. Security teams should also review their webhook endpoint configurations to ensure that receiving systems validate token authenticity or user context before processing incoming payloads, adding an additional layer of defense against unauthorized data ingestion.