CVE-2026-120449

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120449", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:19.510Z", "datePublished": "2026-11-02T14:29:08.144Z", "dateUpdated": "2026-11-02T15:43:10.300Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:08.144Z"}, "datePublic": "2026-10-24T00:00:00.000Z", "title": "Outline before 1.12.0 Improper Access Control via Public Document Shares", "descriptions": [{"lang": "en", "value": "Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Operation on a Resource after Expiration or Release", "cweId": "CWE-672", "type": "CWE"}]}], "affected": [{"vendor": "Outline", "product": "Outline", "packageURL": "pkg:github/outline/outline", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.12.0", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/outline/outline"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.12.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rq53-m97j-f2pg)"}, {"url": "https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52", "tags": ["patch"]}, {"url": "https://github.com/outline/outline/releases/tag/v1.12.0", "tags": ["release-notes"], "name": "Outline v1.12.0 Release Notes"}, {"url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via Public Document Shares", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares"}], "credits": [{"lang": "en", "value": "VG", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:42:37.475888Z", "id": "CVE-2026-120449", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:43:10.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120449", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:42:37.475888Z"}}}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:42:54.750Z"}}], "cna": {"title": "Outline before 1.12.0 Improper Access Control via Public Document Shares", "credits": [{"lang": "en", "type": "finder", "value": "VG"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/outline/outline", "vendor": "Outline", "product": "Outline", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.0", "versionType": "semver"}], "packageURL": "pkg:github/outline/outline", "defaultStatus": "unaffected"}], "datePublic": "2026-10-24T00:00:00.000Z", "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg", "name": "GitHub Security Advisory (GHSA-rq53-m97j-f2pg)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52", "tags": ["patch"]}, {"url": "https://github.com/outline/outline/releases/tag/v1.12.0", "name": "Outline v1.12.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares", "name": "VulnCheck Advisory: Outline before 1.12.0 Improper Access Control via Public Document Shares", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-672", "description": "Operation on a Resource after Expiration or Release"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.12.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:08.144Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120449", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:43:10.300Z", "dateReserved": "2026-11-02T12:42:19.510Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:08.144Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/outline/outline", "product": "Outline", "repo": "https://github.com/outline/outline", "vendor": "Outline", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."}], "id": "CVE-2026-120449", "lastModified": "2026-11-02T19:34:23.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120449", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:42:37.475888Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:27.937", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/outline/outline/releases/tag/v1.12.0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-672"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Outline", "source": "cna", "vendor": "Outline"}, "product": "outline", "vendor": "getoutline"}], "created": "2026-11-02T15:30:14.815883+00:00", "updated": "2026-11-02T16:30:17.965317+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}