CVE-2026-120449 (GCVE-0-2026-120449)
Vulnerability from cvelistv5
Published
2026-11-02 14:29
Modified
2026-11-02 15:43
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-672 - Operation on a Resource after Expiration or Release
Summary
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
References
Impacted products
Vendor Product Version
Outline Outline Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120449",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T15:42:37.475888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T15:43:10.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/outline/outline",
          "product": "Outline",
          "repo": "https://github.com/outline/outline",
          "vendor": "Outline",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "VG"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-672",
              "description": "Operation on a Resource after Expiration or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T14:29:08.144Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rq53-m97j-f2pg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52"
        },
        {
          "name": "Outline v1.12.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/outline/outline/releases/tag/v1.12.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77"
        },
        {
          "name": "VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via Public Document Shares",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares"
        }
      ],
      "title": "Outline before 1.12.0 Improper Access Control via Public Document Shares",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120449",
    "datePublished": "2026-11-02T14:29:08.144Z",
    "dateReserved": "2026-11-02T12:42:19.510Z",
    "dateUpdated": "2026-11-02T15:43:10.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-120449\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-02T15:42:37.475888Z\"}}}], \"references\": [{\"url\": \"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-02T15:42:54.750Z\"}}], \"cna\": {\"title\": \"Outline before 1.12.0 Improper Access Control via Public Document Shares\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"VG\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"repo\": \"https://github.com/outline/outline\", \"vendor\": \"Outline\", \"product\": \"Outline\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.12.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:github/outline/outline\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-10-24T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg\", \"name\": \"GitHub Security Advisory (GHSA-rq53-m97j-f2pg)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/outline/outline/releases/tag/v1.12.0\", \"name\": \"Outline v1.12.0 Release Notes\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares\", \"name\": \"VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via Public Document Shares\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-672\", \"description\": \"Operation on a Resource after Expiration or Release\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.12.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-11-02T14:29:08.144Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-120449\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-02T15:43:10.300Z\", \"dateReserved\": \"2026-11-02T12:42:19.510Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-11-02T14:29:08.144Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.