CVE-2026-113611

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

EUVD-2026-105089

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611

Versions of Outline prior to 1.8.0 are vulnerable to an improper access revocation flaw. The UserDeletedProcessor fails to disable WebhookSubscription rows when an administrator is deleted. Consequently, former administrators who registered webhooks before their account deletion continue to recei...

PT-2026-118471

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.8.0 Description An improper access revocation issue exists where deleted administrators continue to receive document contents. This occurs because the UserDeletedProcessor fails to disable WebhookSubscription rows...

Outline: Authorization Issues Vulnerabilities

Outline: Versions before 1.8.0 have an authorization issue vulnerability. This vulnerability stems from improper access revocation. UserDeletedProcessor did not disable the webhook subscription for the deleted administrator, allowing it to continue receiving full document content through...