Outline versions prior to 1.12.0 contain an incorrect authorization flaw in authorizeDocumentPublish() that lets any authenticated member publish documents into private collections without having write permissions. The vulnerability is exploited by detaching a child document using documents.unpublish while keeping the parentDocumentId, then updating the document with a private collection UUID, allowing malicious content such as phishing pages to be injected.

The affected product is Outline (getoutline). All deployments running Outline versions earlier than 1.12.0 are vulnerable. The vulnerability is linked to the code paths that handle document publishing and detach actions.

The CVSS score of 5.3 indicates moderate severity; no EPSS data is provided and the vulnerability is not listed in CISA KEV. An attacker needs only authenticated access with permission to call the API but does not require write rights to a private collection. Exploitation would involve detaching a document via the unpublish endpoint and then updating it to a private collection, thereby injecting content. Given the lack of publicly known exploitation reports, the likelihood appears low but the impact on confidentiality and integrity of private content can be significant.