Auth bypass in Outline
CVE-2026-54573
Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts th…
Vulnerability class: Broken Access Control
Affected products
- Outline — versions < 1.8.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)