CVE-2026-113611: Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Outlineto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Outline versions before 1.8.0 are exposed if an administrator registered a webhook subscription and was later deleted. The former administrator may continue receiving document contents for matching workspace events.
What access is required to exploit it?
The attacker must previously have had administrator privileges and created a webhook subscription before their account was deleted. No further user interaction is required after deletion.
What data can a former administrator receive?
Affected webhook deliveries can include full document bodies, including Markdown and Yjs data, for every matching workspace event.
How can I determine whether we may already be affected?
Review webhook subscription records for subscriptions associated with deleted administrator accounts. Also review webhook delivery destinations and logs for document-content deliveries made after an administrator was deleted.
What should be done if upgrading is not immediately possible?
Disable or remove webhook subscriptions associated with deleted administrators, and revoke access to their configured webhook endpoints where possible. Upgrading to Outline 1.8.0 addresses the missing revocation behavior.