Vulnerability Description
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Getoutline | Outline | >= 0.86.0, < 1.7.0 |
Related Weaknesses (CWE)
References
- https://github.com/outline/outline/commit/1b91a295e10f58a1088c54f533773788325ff4Patch
- https://github.com/outline/outline/releases/tag/v1.7.0Release Notes
- https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7ExploitVendor Advisory
- https://github.com/outline/outline/security/advisories/GHSA-23jj-rp48-w7q7ExploitVendor Advisory
FAQ
What is CVE-2026-41649?
CVE-2026-41649 is a vulnerability with a CVSS score of 7.7 (HIGH). Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When ...
How severe is CVE-2026-41649?
CVE-2026-41649 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41649?
Check the references section above for vendor advisories and patch information. Affected products include: Getoutline Outline.