CVE-2026-43886: Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard scope by requesting scope=read , escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43886?
CVE-2026-43886 has been classified with a moderate severity level due to its potential impact on OAuth scope validation.
How do I fix CVE-2026-43886?
To fix CVE-2026-43886, update Outline to version 1.6.2 or later, which addresses the logic error in OAuth scope validation.
What versions of Outline are affected by CVE-2026-43886?
CVE-2026-43886 affects Outline versions from 0.84.0 to 1.6.1.
Can CVE-2026-43886 be exploited to gain unauthorized access?
Yes, an attacker can exploit CVE-2026-43886 to gain unauthorized access if they can manipulate the OAuth scopes.
Is there a workaround for CVE-2026-43886 if I cannot upgrade immediately?
As a workaround for CVE-2026-43886, review and restrict OAuth scope permissions until you can apply the update.