CVE-2026-120489: Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Published Nov 2, 2026

Updated

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Outline to a version that resolves this vulnerability.
Fixed in 1.12.0

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Outline member can exploit it. The member does not need write access to the target private collection.

What does an attacker need to do to inject content into a private collection?

The attacker needs a child document that can be detached using documents.unpublish while retaining its parentDocumentId. They can then call documents.update with the UUID of a private collection to publish the detached document there.

Are private collections affected?

Yes. The flaw allows content to be published into private collections even when the authenticated member lacks write access to those collections.

What version addresses the vulnerability?

The issue affects Outline versions before 1.12.0. Upgrade to version 1.12.0 or later.

CVE-2026-120489: Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to inject content into a private collection?

Are private collections affected?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to inject content into a private collection?

Are private collections affected?

What version addresses the vulnerability?