CVE-2026-113611

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

EUVD-2026-105089

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving ful...

CVE-2026-113611

Versions of Outline prior to 1.8.0 are vulnerable to an improper access revocation flaw. The UserDeletedProcessor fails to disable WebhookSubscription rows when an administrator is deleted. Consequently, former administrators who registered webhooks before their account deletion continue to recei...

PT-2026-118471

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.8.0 Description An improper access revocation issue exists where deleted administrators continue to receive document contents. This occurs because the UserDeletedProcessor fails to disable WebhookSubscription rows...

PT-2026-41496

Summary The AxonFlow SDK's WebhookSubscription or equivalent type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook...

PT-2026-41497

Summary The AxonFlow SDK's WebhookSubscription or equivalent type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook...

PT-2026-41479

Summary The AxonFlow SDK's WebhookSubscription or equivalent type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook...