Outline before version 1.8.0 suffers from an improper access revocation flaw that allows deleted administrators to retain webhook subscriptions. Because the UserDeletedProcessor does not disable or delete the WebhookSubscription rows for a removed admin, the former user continues to receive full document contents, including Markdown and Yjs data, for any matching workspace event. This flaw falls under CWE-863, representing an authority not revoked weakness, and results in a confidentiality breach where formerly privileged users can access documents after deletion.

The vulnerability affects the Outline application, specifically all releases prior to 1.8.0, including v1.7.1. The issue is tied to the server/queues/processors/UserDeletedProcessor.ts component. Any instance running a version earlier than 1.8.0 that still allows webhook configuration for deleted administrators is impacted.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is an internal or privileged user who previously had administrator rights. The attacker must have already registered a webhook before deletion; no external exploitation is required. The exploit does not enable code execution but can lead to unintended data disclosure to an orphaned sink.