Outline has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 4.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-120449Medium· 5.3Outline before 1.12.0 Improper Access Control via Public Document Shares41CVE-2026-113611Medium· 4.9Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions39CVE-2026-120489Medium· 4.3Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft24
Outline vulnerabilities
CVEs affecting Outline, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-120489Medium· 4.3Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child docu…
CVE-2026-120449Medium· 5.3PoCOutline before 1.12.0 Improper Access Control via Public Document Shares
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can que…
CVE-2026-113611Medium· 4.9PoCOutline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins wh…