Live › vulnerability › CVE-2026-120449
Outline before 1.12.0 ignores the unpublished status when loading shared documents. Anyone holding an existing share link can read content the owner has withdrawn, and the share cannot be revoked through the API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that self-host Outline before 1.12.0 and use share links for documents. Exposure depends on whether shared links to unpublished content exist; the sources do not say how common that setup is. Hosted or newer deployments are outside the stated range.
No product ranges from the sources yet.
1.12.0 is affected).1.12.0 or later (per the sources; patch and release notes are linked from NVD).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
This page as .md · .json · in your agent: get_signal("CVE-2026-120449")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.