CVE-2026-24901

Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-17 16:16

Updated : 2026-03-19 19:32

NVD link : CVE-2026-24901

Mitre link : CVE-2026-24901

CVE.ORG link : CVE-2026-24901

JSON object : View

Products Affected

getoutline

outline

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-24901", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-17T16:16:20.350", "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. Antes de la 1.4.0, una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en la l\u00f3gica de restauraci\u00f3n de documentos permite a cualquier miembro del equipo restaurar, ver y tomar posesi\u00f3n de forma no autorizada de borradores eliminados pertenecientes a otros usuarios, incluidos los administradores. Al eludir la validaci\u00f3n de propiedad durante el proceso de restauraci\u00f3n, un atacante puede acceder a informaci\u00f3n privada sensible y dejar al propietario original sin acceso a su propio contenido. La versi\u00f3n 1.4.0 soluciona el problema."}], "lastModified": "2026-03-19T19:32:41.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1297792-2032-4407-B790-09BFBDF42500", "versionEndExcluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}