CVE-2026-44695

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44695", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T17:07:09.316Z", "datePublished": "2026-05-11T21:11:25.679Z", "dateUpdated": "2026-05-12T13:30:44.950Z"}, "containers": {"cna": {"title": "Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v"}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"version": "< 1.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T21:11:25.679Z"}, "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a logged-in Outline user complete the callback and link that user's Outline account to the attacker's Slack team_id and user_id. The linked Slack identity can then use the Slack /outline search command as the victim Outline user. This vulnerability is fixed in 1.7.1."}], "source": {"advisory": "GHSA-mjgw-5j7q-gv8v", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T13:30:41.528321Z", "id": "CVE-2026-44695", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T13:30:44.950Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity", "source": {"advisory": "GHSA-mjgw-5j7q-gv8v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"status": "affected", "version": "< 1.7.1"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "name": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a logged-in Outline user complete the callback and link that user's Outline account to the attacker's Slack team_id and user_id. The linked Slack identity can then use the Slack /outline search command as the victim Outline user. This vulnerability is fixed in 1.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T21:11:25.679Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44695", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:30:41.528321Z"}}}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-12T13:30:37.191Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-44695", "state": "PUBLISHED", "dateUpdated": "2026-05-11T21:11:25.679Z", "dateReserved": "2026-05-07T17:07:09.316Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T21:11:25.679Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "outline", "vendor": "outline", "versions": [{"status": "affected", "version": "< 1.7.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "matchCriteriaId": "C47F4265-A7DD-4889-B7D6-B643C322959C", "versionEndExcluding": "1.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a logged-in Outline user complete the callback and link that user's Outline account to the attacker's Slack team_id and user_id. The linked Slack identity can then use the Slack /outline search command as the victim Outline user. This vulnerability is fixed in 1.7.1."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. Antes de la 1.7.1, la devoluci\u00f3n de llamada de la integraci\u00f3n de Slack para GET /auth/slack.post acepta un valor de estado de OAuth sin firmar e independiente de la sesi\u00f3n. Un tercero que puede obtener un c\u00f3digo OAuth de Slack para el mismo cliente de Slack de Outline puede hacer que un usuario de Outline con sesi\u00f3n iniciada complete la devoluci\u00f3n de llamada y vincule la cuenta de Outline de ese usuario al team_id y user_id de Slack del atacante. La identidad de Slack vinculada puede entonces usar el comando de b\u00fasqueda /outline de Slack como el usuario de Outline v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.7.1."}], "id": "CVE-2026-44695", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44695", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T13:30:41.528321Z", "version": "2.0.3"}}]}, "published": "2026-05-11T22:22:14.347", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.1)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "outline", "source": "cna", "vendor": "outline"}, "product": "outline", "vendor": "getoutline"}], "created": "2026-05-11T23:45:03.141172+00:00", "updated": "2026-05-12T09:00:06.422876+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}