CVE-2026-120449
5.3 MEDIUMpublic exploit availablePublished 2026-11-02 · Updated 2026-11-02
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-672
Public exploit & PoC references
- https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77
- https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
- https://github.com/outline/outline/releases/tag/v1.12.0
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
All references
- https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77
- https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
- https://github.com/outline/outline/releases/tag/v1.12.0
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
- https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares
- https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-106310
- MEDIUMCVE-2026-106320
- LOWCVE-2026-106339
- MEDIUMCVE-2026-106345
- UNSCOREDCVE-2026-115402
- UNSCOREDCVE-2026-53918PoC
- MEDIUMCVE-2026-57446PoC
- HIGHCVE-2026-62966PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.