---
id: "CVE-2026-120449"
kind: "vulnerability"
aliases: ["CVE-2026-120449"]
title: "Outline: unpublished documents readable through share links before 1.12.0"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["documentation", "other", "outline", "self-hosted"]
not_affected_if: ["managed-hosting", "version-1.12.0-or-later"]
published_at: "2026-11-02T15:17:27+00:00"
first_seen_at: "2026-11-02T15:24:03+00:00"
updated_at: "2026-11-02T15:26:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120449", "first_seen_at": "2026-11-02T15:24:03+00:00"}]
---

# Outline: unpublished documents readable through share links before 1.12.0

Outline before 1.12.0 ignores the unpublished status when loading shared documents. Anyone holding an existing share link can read content the owner has withdrawn, and the share cannot be revoked through the API.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Outline version against the range in the sources (before `1.12.0` is affected).
- Look in the Outline admin settings or deployment config for the version actually running.

## Fix

- Outline `1.12.0` or later (per the sources; patch and release notes are linked from NVD).

## Timeline

- 2026-11-02T15:24:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120449

## Documents

- [advisory] Vendor advisory: github.com https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares
- [fix] Patch: github.com https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
- [fix] Release notes: github.com https://github.com/outline/outline/releases/tag/v1.12.0

## From the sources

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_