{"id":"CVE-2026-120449","kind":"vulnerability","aliases":["CVE-2026-120449"],"related":[],"title":"Outline: unpublished documents readable through share links before 1.12.0","description":"Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.","summary":"Outline before 1.12.0 ignores the unpublished status when loading shared documents. Anyone holding an existing share link can read content the owner has withdrawn, and the share cannot be revoked through the API.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["documentation","other","outline","self-hosted"],"not_affected_if":["managed-hosting","version-1.12.0-or-later"],"how_to_check":"- Check the installed Outline version against the range in the sources (before `1.12.0` is affected).\n- Look in the Outline admin settings or deployment config for the version actually running.","fix":"- Outline `1.12.0` or later (per the sources; patch and release notes are linked from NVD).","status":"open","published_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:26:10+00:00","updated_at":"2026-11-02T15:26:10+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T15:26:10Z","model":"claude-haiku-5-5","output":{"fix":"- Outline `1.12.0` or later (per the sources; patch and release notes are linked from NVD).","reach":"internet","title":"Outline: unpublished documents readable through share links before 1.12.0","impact":"medium","summary":"Outline before 1.12.0 ignores the unpublished status when loading shared documents. Anyone holding an existing share link can read content the owner has withdrawn, and the share cannot be revoked through the API.","audience":"businesses","category":"other","nicknames":[],"who_cares":["outline","self-hosted","documentation"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Withdrawn document content readable by anyone holding a share link","analyst_note":"","how_to_check":"- Check the installed Outline version against the range in the sources (before `1.12.0` is affected).\n- Look in the Outline admin settings or deployment config for the version actually running.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-1.12.0-or-later"],"who_is_affected":"Teams that self-host Outline before 1.12.0 and use share links for documents. Exposure depends on whether shared links to unpublished content exist; the sources do not say how common that setup is. Hosted or newer deployments are outside the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":4206,"output_tokens":487,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120449':12A,15A '-2026':11A,14A '/s':91C '1.12.0':9A,24B,57C '404':101C 'access':61C 'allow':65C 'anyon':33B 'api':54B 'attack':79C 'block':103C 'cannot':49B 'contain':58C 'content':41B,97C 'control':62C 'cve':10A,13A 'document':3A,16B,32B,71C 'documents.info':88C 'exist':36B,82C 'hold':34B,80C 'host':21B 'ignor':25B,76C 'improp':60C 'link':7A,38B,84C 'load':30B 'loader':75C 'outlin':1A,18B,22B,55C 'owner':43B 'queri':86C 'read':40B,69C,95C 'readabl':4A 'return':100C 'revoc':104C 'revok':51B 'rout':93C 'self':20B 'self-host':19B 'share':6A,31B,37B,48B,74C,83C,92C 'shares.info':87C 'shares.revoke':99C 'status':28B,78C 'unauthent':66C 'unpublish':2A,27B,70C,77C 'user':67C 'vulner':63C 'withdrawn':45B,96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Outline before 1.12.0 and use share links for documents. Exposure depends on whether shared links to unpublished content exist; the sources do not say how common that setup is. Hosted or newer deployments are outside the stated range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["documentation","medium","other","outline","selfhosted"],"first_public_at":"2026-10-24T02:47:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120449","severity":null,"published_at":"2026-11-02T15:17:27+00:00","modified_at":"2026-11-02T15:17:27+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52487,"url":"https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52488,"url":"https://github.com/outline/outline/releases/tag/v1.12.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52489,"url":"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T02:47:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52490,"url":"https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}