PT-2026-135480

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...