CVE-2026-43890— Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route handler authorizes ONLY the collection branch (line 125 if (collectionId)), while the downstream subscriptionCreator command at server/commands/subscriptionCreator.ts writes the subscription against the documentId (which was never validated). The result is a subscription record pinning the attacker's user to a victim document the attacker has no read access to, on any team in the instance. The schema (server/routes/api/subscriptions/schema.ts) only enforces "at least one of collectionId/documentId" via .refine() — it does NOT enforce mutual exclusivity, so passing both is a valid, schema-conforming request. This vulnerability is fixed in 1.7.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

通过用户控制密钥绕过授权机制

Outline 安全漏洞

Outline是Outline开源的一个知识库。 Outline 0.84.0版本至1.7.0版本存在安全漏洞，该漏洞源于subscriptions.create API端点存在损坏的授权模式，当同时提供collectionId和documentId时，路由处理程序仅授权集合分支，而下游subscriptionCreator命令针对未验证的documentId写入订阅，导致订阅记录将攻击者用户固定到攻击者无读取权限的受害者文档上。

N/A

N/A