{"id":"CVE-2026-113611","kind":"vulnerability","aliases":["CVE-2026-113611"],"related":[],"title":"Outline: deleted admins keep receiving document contents via webhooks","description":"Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.","summary":"Outline before 1.8.0 does not disable webhook subscriptions when an administrator is deleted. The former admin keeps receiving full document bodies, including Markdown and Yjs data, for workspace events.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["outline","package","self-hosted","webhooks"],"not_affected_if":["managed-hosting","no-webhooks"],"how_to_check":null,"fix":"- Upgrade Outline to `1.8.0` or later.\n- Review existing webhook subscriptions in the workspace and remove any tied to deleted users.","status":"open","published_at":"2026-10-20T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:27+00:00","updated_at":"2026-10-25T03:40:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Outline to `1.8.0` or later.\n- Review existing webhook subscriptions in the workspace and remove any tied to deleted users.","reach":"internet","title":"Outline: deleted admins keep receiving document contents via webhooks","impact":"medium","summary":"Outline before 1.8.0 does not disable webhook subscriptions when an administrator is deleted. The former admin keeps receiving full document bodies, including Markdown and Yjs data, for workspace events.","category":"package","nicknames":[],"who_cares":["outline","self-hosted","webhooks"],"confidence":0.6,"needs_auth":"yes","worst_case":"Former admin receives full document contents from workspace events","analyst_note":"Confirm the patched release and whether existing subscriptions are cleaned up on upgrade; check the NVD entry for the fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-webhooks","managed-hosting"],"who_is_affected":"Self-hosted or cloud Outline workspaces that have webhook subscriptions registered by administrators who were later deleted. Workspaces with no webhooks, or where no admin was removed after registering one, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000567,"input_tokens":3345,"output_tokens":465,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113611':12A,15A '-2026':11A,14A '1.8.0':24B,53C 'access':57C 'admin':3A,37B,77C 'administr':32B,63C 'allow':61C 'bodi':42B,87C 'contain':54C 'content':7A,68C 'continu':83C 'cve':10A,13A 'data':47B,92C 'delet':2A,34B,62C,82C 'deliverwebhooktask':94C 'disabl':27B,72C 'document':6A,41B,67C,86C 'event':50B,99C 'everi':96C 'former':36B,76C 'full':40B,85C 'host':20B 'improp':56C 'includ':43B,88C 'keep':4A,38B,65C 'markdown':44B,89C 'match':97C 'never':71C 'outlin':1A,16B,22B,51C 'packag':17B 'receiv':5A,39B,66C,84C 'regist':79C 'revoc':58C 'row':75C 'self':19B 'self-host':18B 'subscript':29B 'userdeletedprocessor':70C 'via':8A,93C 'vulner':59C 'webhook':9A,21B,28B,80C 'webhooksubscript':74C 'workspac':49B,98C 'yjs':46B,91C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud Outline workspaces that have webhook subscriptions registered by administrators who were later deleted. Workspaces with no webhooks, or where no admin was removed after registering one, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113611","severity":null,"published_at":"2026-10-20T16:17:11+00:00","modified_at":"2026-10-23T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}