CVE-2026-24901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24901", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.529Z", "datePublished": "2026-03-17T15:28:28.363Z", "dateUpdated": "2026-03-17T15:46:23.976Z"}, "containers": {"cna": {"title": "Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5"}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"version": "< 1.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-17T15:28:28.363Z"}, "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue."}], "source": {"advisory": "GHSA-gmr5-43f5-79f5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T15:45:59.581832Z", "id": "CVE-2026-24901", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:46:23.976Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24901", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-17T15:45:59.581832Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:46:13.467Z"}}], "cna": {"title": "Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts", "source": {"advisory": "GHSA-gmr5-43f5-79f5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5", "name": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-17T15:28:28.363Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24901", "state": "PUBLISHED", "dateUpdated": "2026-03-17T15:46:23.976Z", "dateReserved": "2026-01-27T19:35:20.529Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-17T15:28:28.363Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "outline", "vendor": "outline", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1297792-2032-4407-B790-09BFBDF42500", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. Antes de la 1.4.0, una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en la l\u00f3gica de restauraci\u00f3n de documentos permite a cualquier miembro del equipo restaurar, ver y tomar posesi\u00f3n de forma no autorizada de borradores eliminados pertenecientes a otros usuarios, incluidos los administradores. Al eludir la validaci\u00f3n de propiedad durante el proceso de restauraci\u00f3n, un atacante puede acceder a informaci\u00f3n privada sensible y dejar al propietario original sin acceso a su propio contenido. La versi\u00f3n 1.4.0 soluciona el problema."}], "id": "CVE-2026-24901", "lastModified": "2026-06-17T10:23:46.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24901", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T15:45:59.581832Z", "version": "2.0.3"}}]}, "published": "2026-03-17T16:16:20.350", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.0)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "outline", "source": "cna", "vendor": "outline"}, "product": "outline", "vendor": "getoutline"}], "analysis": {"en": {"generated_at": "2026-03-19T20:27:11.384538+00:00", "value": {"mitigation_remediation": ["Upgrade Outline to version\u202f1.4.0 or later"], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to private drafts and ownership seizure"}, "threat_synthesis": {"affected_systems": "The affected product is Outline by getoutline. All deployments running any version prior to 1.4.0 are vulnerable, regardless of environment or deployment method. Versions 1.4.0 and later include the fix.", "description_and_impact": "Outline\u2019s document restoration logic before version\u202f1.4.0 contains an insecure direct object reference (IDOR) that lets any authenticated team member restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. This flaw bypasses ownership validation, allowing attackers to read sensitive private content and lock the original owner out of their own documents. The primary impact is the compromise of confidentiality and omission of proper authorization controls, categorised as CWE\u2011639.", "risk_and_exploitability": "The CVSS score of 8.1 signals a high severity vulnerability, while the EPSS score of less than\u202f1\u202f% indicates a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated team members with access to the collaboration platform; the exploit requires interaction with the document restoration endpoint to trigger the IDOR. If successfully exploited, the attacker gains unauthorized information disclosure and ownership control over deleted documents."}}}}, "created": "2026-03-18T12:13:17.815291+00:00", "updated": "2026-03-24T10:49:12.533678+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}