CVE-2023-3532

CVE-2023-3532 concerns a stored XSS in Outline (outline/outline) prior to version 0.70.1. The root cause described in connected sources is improper handling of user-supplied content stored for display, enabling injection of malicious scripts when documents or embeds are viewed. Specific attack ve...

CVE-2024-37830

Summary: CVE-2024-37830 affects Outline up to v0.76.1. An issue allows an attacker to redirect a victim to a malicious site by intercepting and modifying the app’s state cookie. The vulnerability is described across Red Hat, NVD, CVE listings and partner advisories, with the recommended fix being...

CVE-2024-40626

Outline is affected by a Stored Cross-Site Scripting (XSS) vulnerability caused by a type confusion in ProseMirror’s rendering path. An authenticated user can embed a malicious payload in a document, which executes in other users’ browsers when the document is viewed. The CSP protections can be b...

CVE-2022-2342

CVE-2022-2342 is a stored XSS vulnerability in the Outline project (outline/outline) prior to version 0.64.4. The issue arises from injecting malicious scripts that are stored and later rendered in user contexts. Public references in the connected data confirm this XSS wording and target: the Out...

CVE-2024-37829

The CVE-2024-37829 issue affects Outline ≤ v0.76.1 and enables a session hijacking attack when a user interacts with a crafted magic sign-in link. The consolidated sources confirm the vulnerability but provide no concrete remediation details (e.g., patched version) within the supplied documents. ...

CVE-2025-64487

Outline is a collaborative documentation service. CVE-2025-64487 describes a privilege escalation in the Outline document management system caused by inconsistent authorization checks between user and group membership endpoints, prior to version 1.1.0. The issue enables lower-privilege users to e...

CVE-2026-33640

CVE-2026-33640 – Outline : The issue affects Outline’s Email OTP login flow. Before v1.6.0, the rate limiter could be bypassed because OTP codes were not invalidated based on amount/frequency of attempts, enabling unrestricted submissions within a code’s lifetime and allowing brute‑force attacks ...

CVE-2026-41649

Outline's shares.create in versions up to 1.7.0 has an insecure direct object reference when both collectionId and documentId are supplied; authorization checks only the collection, enabling authenticated users to generate a public share link for any document (even in other workspaces) and access...

CVE-2026-25062

Outline (the Outline service) prior to version 1.4.0 is vulnerable via JSON import where attachments[].key is passed to path.join(rootPath, node.key) and then read with fs.readFile without validation, enabling path traversal (e.g., ../ or absolute paths) to read arbitrary server files and import ...

CVE-2025-68663

Outline before version 1.1.0 contains a vulnerability in its WebSocket authentication mechanism that allows suspended users to maintain or establish real-time WebSocket connections and continue receiving sensitive operational updates after suspension. The issue is fixed in 1.1.0. CVSS metadata in...

CVE-2026-44695

Summary: CVE-2026-44695 affects Outline before version 1.7.1. The Slack OAuth flow for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. If an attacker can obtain a Slack OAuth code for the same Outline Slack client, they can cause a logged-in Outline user to comple...

CVE-2025-58351

Outline versions 0.72.0–0.83.0 include a local file storage feature that can bypass CSP and Content-Type checks when FILE_STORAGE=local is used on the same domain. A malicious payload uploaded as a file attachment could be executed in another user’s context. This is fixed in version 0.84.0. The c...

CVE-2026-24901

Summary: CVE-2026-24901 affects Outline prior to 1.4.0, with an Insecure Direct Object Reference (IDOR) in the document restoration logic. This allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users (including administrators) by bypa...

CVE-2023-54331

CVE-2023-54331 stems from an unquoted service path in Outline 1.6.0, specifically the OutlineService executable, enabling local attackers to potentially execute arbitrary code with LocalSystem privileges. The PT-2026-2421 advisory confirms the vulnerable component and describes the exploitation v...

CVE-2026-28506

The CVE-2026-28506 affects Outline prior to 1.5.0. A logic flaw in the events.list API endpoint’s filtering lets any authenticated user retrieve activity events for documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user’s actual permissions. This resul...