Live › vulnerability › CVE-2026-113611
Go to dashboardOutline before 1.8.0 does not disable webhook subscriptions when an administrator is deleted. The former admin keeps receiving full document bodies, including Markdown and Yjs data, for workspace events.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or cloud Outline workspaces that have webhook subscriptions registered by administrators who were later deleted. Workspaces with no webhooks, or where no admin was removed after registering one, are not exposed by this flaw.
No product ranges from the sources yet.
Unknown from the sources.
1.8.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
This page as .md · .json · in your agent: get_signal("CVE-2026-113611")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.