CVE-2026-120489
4.3 MEDIUMpublic exploit availablePublished 2026-11-02 · Updated 2026-11-02
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Public exploit & PoC references
- https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143
- https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc
- https://github.com/outline/outline/releases/tag/v1.12.0
- https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2
All references
- https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143
- https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc
- https://github.com/outline/outline/releases/tag/v1.12.0
- https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2
- https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-authorizedocumentpublish-detached-draft
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2025-13050PoC
- UNSCOREDCVE-2025-68392
- HIGHCVE-2026-100105
- MEDIUMCVE-2026-100145
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
Related by shared AI tags and CWE weakness class. Browse the full archive.