Outline vulnerabilities
We track 8 vulnerabilities in Outline products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on May 11, 2026.
Latest Outline vulnerabilities
- 7.7 High severity
outline: Authorization Bypass Through User-Controlled Key
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are
- 8.7 High severity
outline: Improper Limitation of a Pathname to a Restricted Directory
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input wh
- 7.3 High severity
outline: Improper Neutralization of Input During Web Page Generation
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions. As a
- 8.2 High severity
outline: Improper Privilege Management
Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single sc
- 7.7 High severity
outline: Authorization Bypass Through User-Controlled Key
Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the req
- 9.8 Critical severity
outline: Improper Restriction of Excessive Authentication Attempts
Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based
- 8.8 High severity
outline: Authorization Bypass Through User-Controlled Key
Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted
- 7.6 High severity
outline: Improper Privilege Management
Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership management endpoi