What is CVE-2026-24901?

CVE-2026-24901 is a high-severity vulnerability in Getoutline Outline, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-03-17.

How severe is CVE-2026-24901?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Getoutline Outline

CVE-2026-24901

Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published 2026-03-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.003 (21.6th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Getoutline Outline
Outline — versions < 1.4.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5 (Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-24901?: CVE-2026-24901 is a high-severity vulnerability in Getoutline Outline, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-03-17.
How severe is CVE-2026-24901?: High severity. CVSS v3 base score is 8.1 out of 10.