Auth bypass in Outline
CVE-2026-113611
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
Vulnerability class: Broken Access Control
Published .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/outline/outline/security/advisories/GHSA-33jq-x32c-3ccw (vendor-advisory)
- github.com/outline/outline/commit/e044014cea958962fc9f5e2b8f6ff1d8cadd676f (patch)
- github.com/outline/outline/releases/tag/v1.8.0 (release-notes)
- github.com/outline/outline/blob/v1.7.1/server/queues/processors/UserDeletedProc… (technical-description)
- www.vulncheck.com/advisories/outline-before-1.8.0-information-disclosure-via-or… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-113611?
- CVE-2026-113611 is a medium-severity vulnerability in Outline, classified under Incorrect Authorization. CVSS score: 4.9/10. Published 2026-10-20.
- How severe is CVE-2026-113611?
- Medium severity. CVSS v3 base score is 4.9 out of 10.