CVE-2026-120449

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-120449

The Outline software (versions before 1.12.0 ) is susceptible to an improper access control vulnerability. The share loader component fails to check the unpublished status of documents, allowing unauthenticated users with an existing share link to access withdrawn content. Specifically, attackers...

EUVD-2026-115209

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...