Outline, the team collaboration platform, has an improper access control flaw that lets anyone who possesses a share link read documents that have not yet been published. The flaw arises because the share loader ignores the unpublished status of documents, allowing attackers to query share information, document details, or the short‑link routes to retrieve hidden content. The result is that confidential or draft information can be exposed to unauthenticated users.

This issue affects all Outline installations running any version prior to 1.12.0. Versions 1.12.0 and later include the fix described in the 1.12.0 release notes. Thus, every deployment of Outline older than 1.12.0 is vulnerable.

The CVSS score of 6.9 reflects a moderate severity with medium potential impact. No EPSS score is available, but the vulnerability is publicly documented in a GitHub advisory alongside the release of a fix. Because exploitation requires only possession of a share link—which can be easily discovered or shared—the risk to organizations using Outline’s public sharing features is significant, even though the vulnerability is not listed in CISA's KEV catalog.