---
id: CVE-2026-120489
title: >-
  Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish()
  Detached Draft
summary: >-
  Outline before 1.12.0 contains an incorrect authorization vulnerability in
  authorizeDocumentPublish() that allows authenticated members to publish
  documents into private collections without write access. Attackers can detach
  a child docu…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Outline
product: Outline
affected:
  - Outline < 1.12.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:04:52.281986Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:30:46.661Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120489'
references:
  - url: 'https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2'
    label: GitHub Security Advisory (GHSA-h6ff-rw9x-5mq2)
  - url: >-
      https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc
  - url: 'https://github.com/outline/outline/releases/tag/v1.12.0'
    label: Outline v1.12.0 Release Notes
  - url: >-
      https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143
  - url: >-
      https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-authorizedocumentpublish-detached-draft
    label: >-
      VulnCheck Advisory: Outline before 1.12.0 Incorrect Authorization via
      authorizeDocumentPublish() Detached Draft
tags:
  - cve.org
epss: 0.00245
epssPercentile: 0.15859
ingestedAt: '2026-11-05T19:30:42.728Z'
---

## Overview

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

## Affected

- `Outline < 1.12.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.