CVE-2026-120449
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Nov 2, 2026
CISA due date
—
The record
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121256 Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-672
- CVE-2026-62966 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32… CWE-672
- CVE-2026-93006 A flaw was found in dnsmasq. CWE-672
- CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a… CWE-672
- CVE-2026-53918 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. CWE-672
- CVE-2026-113216 Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a… CWE-672
- CVE-2026-113121 Use of released resource in ContextMenu in Google Chrome on on Android prior to… CWE-672
- CVE-2026-57446 libIEC61850 is an open-source implementation of IEC 61850 client and server protocols… CWE-672