CVE-2026-120449Medium· 5.3▾ TwilightPoC availableOutline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can que…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.
Outline < 1.12.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120489Medium· 4.3Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
CVE-2026-113611Medium· 4.9Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions
CVE-2026-53918High· 8.8odhcpd DHCPv6 IA dangling first pointer use-after-free
CVE-2026-57446Medium· 5.3libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
CVE-2026-95366Medium· 6.5Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page
CVE-2026-61699High· 8.1nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN