CVE-2026-41649— Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces

Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

通过用户控制密钥绕过授权机制

Outline 安全漏洞

Outline是Outline开源的一个知识库。 Outline 0.86.0版本至1.7.0之前版本存在安全漏洞，该漏洞源于不安全的直接对象引用，当请求中同时提供collectionId和documentId时，授权逻辑仅检查对集合的访问，完全忽略文档，可能导致经过身份验证的攻击者为平台上的任何文档生成有效的公共共享链接，并通过documents.info端点检索完整文档内容。

N/A

N/A