CVE-2026-120489— Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Quick assessment

Affected

Outline Outline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.12.0 之前的 Outline 版本中，函数存在授权逻辑错误漏洞。该漏洞允许已认证成员在缺乏写权限的情况下，将文档发布到私有集合中。攻击者可先通过操作将子文档从其父文档中分离（同时保留），随后调用并传入私有集合的 UUID，从而向私有集合中注入钓鱼内容。

CVSS 4.3 · Medium EPSS 0.24% · P16 Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1190 · Exploit Public-Facing Application T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing Link

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Outline	Outline	`< 1.12.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Source: CVE Program / CVE List V5

Vulnerability Description

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Outline	Outline	0 ~ 1.12.0	-

II. Public POCs for CVE-2026-120489

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120489

请登录查看更多情报信息。

Other References for CVE-2026-120489 (5)

https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143 technical-description
https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc patch
https://github.com/outline/outline/releases/tag/v1.12.0 release-notes
https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2 vendor-advisory
https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-authorizedocumentpublish-detached-draft third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120489

IV. Related Vulnerabilities

Same product: Outline

Same vendor: Outline

Same weakness: CWE-863