Cloudanix VulnDB

CVE-2026-43889

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

May 11, 2026

CISA due date

—

The record

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities