---
id: CVE-2026-120449
title: Outline before 1.12.0 Improper Access Control via Public Document Shares
summary: >-
  Outline before 1.12.0 contains an improper access control vulnerability that
  allows unauthenticated users to read unpublished documents because the share
  loader ignores unpublished status. Attackers holding an existing share link
  can que…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-672
vendor: Outline
product: Outline
affected:
  - Outline < 1.12.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T15:42:37.475888Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:43:10.300Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120449'
references:
  - url: 'https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg'
    label: GitHub Security Advisory (GHSA-rq53-m97j-f2pg)
  - url: >-
      https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52
  - url: 'https://github.com/outline/outline/releases/tag/v1.12.0'
    label: Outline v1.12.0 Release Notes
  - url: >-
      https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77
  - url: >-
      https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares
    label: >-
      VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via
      Public Document Shares
tags:
  - cve.org
  - exploit-available
epss: 0.00443
epssPercentile: 0.38746
ingestedAt: '2026-11-05T19:30:42.694Z'
---

## Overview

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.

## Affected

- `Outline < 1.12.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.