Description
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.
INFO
Published Date :
2026-04-28T20:11:28.283Z
Last Modified :
2026-04-29T13:12:25.759Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-41649 vulnerability.
| Vendors | Products |
|---|---|
| Getoutline |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41649.
