CVE-2026-120489 in Outline
Summary
by MITRE • 11/02/2026
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Outline versions prior to 1.12.0 represents a critical failure in server-side authorization logic within the application's document management subsystem. Specifically, the flaw resides in the authorizeDocumentPublish function, which is responsible for validating user permissions before allowing documents to be published or moved into collections. The core technical issue stems from an incorrect implementation of access control checks that fail to adequately verify whether the authenticated user possesses write privileges on the target private collection. This oversight allows any authenticated member, regardless of their specific role or permission level within a given workspace, to bypass intended restrictions and manipulate document placement in ways not authorized by the system's security model.
From an operational perspective, this vulnerability enables attackers with valid credentials but limited permissions to perform unauthorized actions that can lead to significant data integrity issues and potential phishing campaigns. By exploiting the documents.unpublish endpoint, an attacker can detach a child document from its current parent while retaining the original parentDocumentId reference in the database structure. This state manipulation creates a window of opportunity where the document's metadata remains partially linked to trusted contexts even after being removed from view or access control boundaries associated with those contexts. The attacker then utilizes the documents.update endpoint, supplying the UUID of a private collection they do not have write access to, effectively injecting content into that restricted area without triggering appropriate permission denials.
The impact of this flaw extends beyond simple unauthorized data modification. Because Outline is often used for collaborative knowledge management and internal documentation, the ability to inject arbitrary content into private collections poses a severe risk to organizational security posture. Attackers can leverage this capability to embed phishing links, malicious scripts, or misleading information within documents that are trusted by other users who have access to those private collections. This undermines the integrity of shared resources and can facilitate social engineering attacks against colleagues who rely on these documents for accurate information. The vulnerability essentially transforms a standard content management feature into a vector for credential harvesting or malware distribution if the injected content is designed to deceive end-users.
This issue aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor obtaining privileges that they are not entitled to exercise within the application's security framework. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Initial Access and Persistence through trusted channels, specifically leveraging legitimate administrative or collaborative functions to bypass security controls. The exploitation path relies on authenticated users rather than unauthenticated attackers, highlighting that even internal threats can exploit these logical flaws if proper segregation of duties is not enforced at the API level.
To mitigate this vulnerability, organizations running Outline versions prior to 1.12.0 should prioritize upgrading to a patched version where the authorization logic in authorizeDocumentPublish has been corrected to strictly validate write permissions against the target collection's UUID before allowing any document updates or moves. Until an upgrade is feasible, administrators can implement network-level controls such as Web Application Firewalls (WAF) rules that monitor for anomalous patterns of document unpublishing followed immediately by update operations targeting private collections with unusual frequency or from users lacking typical write histories. Additionally, enabling detailed audit logging on the database and application layers will help in detecting attempts to manipulate parentDocumentId references during these transitions, allowing for rapid incident response if such activity is observed.