---
id: "CVE-2026-113611"
kind: "vulnerability"
aliases: ["CVE-2026-113611"]
title: "Outline: deleted admins keep receiving document contents via webhooks"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["outline", "package", "self-hosted", "webhooks"]
not_affected_if: ["managed-hosting", "no-webhooks"]
published_at: "2026-10-20T16:17:11+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113611", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Outline: deleted admins keep receiving document contents via webhooks

Outline before 1.8.0 does not disable webhook subscriptions when an administrator is deleted. The former admin keeps receiving full document bodies, including Markdown and Yjs data, for workspace events.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade Outline to `1.8.0` or later.
- Review existing webhook subscriptions in the workspace and remove any tied to deleted users.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113611

## From the sources

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_