CVE-2026-43889: Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43889?
CVE-2026-43889 has been rated as a high severity vulnerability due to the improper access control in the shares.create API.
How do I fix CVE-2026-43889?
To fix CVE-2026-43889, upgrade to Outline version 1.7.0 or later, where this vulnerability has been addressed.
What impact does CVE-2026-43889 have on my data?
CVE-2026-43889 can potentially allow unauthorized users to access and modify shared documents by bypassing the share permission checks.
Who is affected by CVE-2026-43889?
Anyone using Outline versions prior to 1.7.0 is affected by CVE-2026-43889 and should take immediate action to upgrade.
What components of Outline are impacted by CVE-2026-43889?
CVE-2026-43889 specifically impacts the shares.create API in Outline, compromising the document sharing permissions.