CVE-2026-28506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28506", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T20:57:47.709Z", "datePublished": "2026-03-17T15:30:24.114Z", "dateUpdated": "2026-03-17T15:45:17.053Z"}, "containers": {"cna": {"title": "Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6g"}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"version": "< 1.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-17T15:30:24.114Z"}, "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user's actual permissions on those documents. While the document content is not directly exposed, this vulnerability leaks sensitive metadata (such as Document IDs, user activity timestamps, and in some specific cases like the Document Title of Permanent Delete). Crucially, leaking valid Document IDs of deleted drafts removes the protection of UUID randomness, making High-severity IDOR attacks (such as the one identified in documents.restore) trivially exploitable by lowering the attack complexity. Version 1.5.0 fixes the issue."}], "source": {"advisory": "GHSA-69x7-6fcr-mm6g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T15:45:05.906327Z", "id": "CVE-2026-28506", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:45:17.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28506", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T15:45:05.906327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:45:10.743Z"}}], "cna": {"title": "Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts", "source": {"advisory": "GHSA-69x7-6fcr-mm6g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"status": "affected", "version": "< 1.5.0"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6g", "name": "https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user's actual permissions on those documents. While the document content is not directly exposed, this vulnerability leaks sensitive metadata (such as Document IDs, user activity timestamps, and in some specific cases like the Document Title of Permanent Delete). Crucially, leaking valid Document IDs of deleted drafts removes the protection of UUID randomness, making High-severity IDOR attacks (such as the one identified in documents.restore) trivially exploitable by lowering the attack complexity. Version 1.5.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-17T15:30:24.114Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28506", "state": "PUBLISHED", "dateUpdated": "2026-03-17T15:45:17.053Z", "dateReserved": "2026-02-27T20:57:47.709Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-17T15:30:24.114Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "outline", "vendor": "outline", "versions": [{"status": "affected", "version": "< 1.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD272F5C-5BF0-4CB5-A2AC-169718EEFCBE", "versionEndExcluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user's actual permissions on those documents. While the document content is not directly exposed, this vulnerability leaks sensitive metadata (such as Document IDs, user activity timestamps, and in some specific cases like the Document Title of Permanent Delete). Crucially, leaking valid Document IDs of deleted drafts removes the protection of UUID randomness, making High-severity IDOR attacks (such as the one identified in documents.restore) trivially exploitable by lowering the attack complexity. Version 1.5.0 fixes the issue."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. Antes de la versi\u00f3n 1.5.0, el endpoint de la API events.list, utilizado para recuperar registros de actividad, contiene un fallo l\u00f3gico en su mecanismo de filtrado. Permite a cualquier usuario autenticado recuperar eventos de actividad asociados con documentos que no tienen colecci\u00f3n (por ejemplo, Borradores Privados, Documentos Eliminados), independientemente de los permisos reales del usuario sobre esos documentos. Aunque el contenido del documento no se expone directamente, esta vulnerabilidad filtra metadatos sensibles (como IDs de Documentos, marcas de tiempo de actividad del usuario, y en algunos casos espec\u00edficos como el T\u00edtulo del Documento de Eliminaci\u00f3n Permanente). Fundamentalmente, la filtraci\u00f3n de IDs de Documentos v\u00e1lidos de borradores eliminados elimina la protecci\u00f3n de la aleatoriedad de los UUID, haciendo que los ataques IDOR de alta severidad (como el identificado en documents.restore) sean trivialmente explotables al reducir la complejidad del ataque. La versi\u00f3n 1.5.0 corrige el problema."}], "id": "CVE-2026-28506", "lastModified": "2026-06-17T10:28:45.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28506", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T15:45:05.906327Z", "version": "2.0.3"}}]}, "published": "2026-03-17T16:16:20.940", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.0)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "outline", "source": "cna", "vendor": "outline"}, "product": "outline", "vendor": "getoutline"}], "analysis": {"en": {"generated_at": "2026-03-19T20:27:02.756068+00:00", "value": {"mitigation_remediation": ["Upgrade Outline to version 1.5.0 or later", "Verify the upgrade succeeded and that events.list responses no longer expose private draft metadata"], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected product: Outline (getoutline:outline). Versions prior to 1.5.0 are vulnerable. The CVE does not specify additional vendors or product variants; only the Outline service is impacted.", "description_and_impact": "The vulnerability resides in the events.list API endpoint of Outline, which is intended to return activity logs. Due to a logic flaw in the filtering mechanism, any authenticated user can request events for documents that have no collection, such as Private Drafts or Deleted Documents. The API then returns metadata including Document IDs, activity timestamps, and occasionally the Document Title for permanently deleted items. This information disclosure can be leveraged to enumerate private drafts and, by revealing valid Document IDs, facilitate IDOR attacks, enabling an attacker to restore or manipulate deleted drafts. The weakness corresponds to CWE-200 (Information Exposure).", "risk_and_exploitability": "The CVSS score is 4.3, indicating a low\u2011to\u2011moderate severity. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation in the wild. Outline is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user, and the attacker can enumerate private drafts and potentially perform IDOR operations by using the exposed Document IDs. Because the credential requirement is low (any authenticated user) and the attack complexity is straightforward, the risk is considered moderate, but overall impact remains limited to information disclosure and potential downstream IDOR weaknesses."}}}}, "created": "2026-03-18T12:13:16.949421+00:00", "updated": "2026-03-24T10:49:11.669698+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}