The vulnerability resides in the events.list API endpoint of Outline, which is intended to return activity logs. Due to a logic flaw in the filtering mechanism, any authenticated user can request events for documents that have no collection, such as Private Drafts or Deleted Documents. The API then returns metadata including Document IDs, activity timestamps, and occasionally the Document Title for permanently deleted items. This information disclosure can be leveraged to enumerate private drafts and, by revealing valid Document IDs, facilitate IDOR attacks, enabling an attacker to restore or manipulate deleted drafts. The weakness corresponds to CWE-200 (Information Exposure).

Affected product: Outline (getoutline:outline). Versions prior to 1.5.0 are vulnerable. The CVE does not specify additional vendors or product variants; only the Outline service is impacted.

The CVSS score is 4.3, indicating a low‑to‑moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. Outline is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user, and the attacker can enumerate private drafts and potentially perform IDOR operations by using the exposed Document IDs. Because the credential requirement is low (any authenticated user) and the attack complexity is straightforward, the risk is considered moderate, but overall impact remains limited to information disclosure and potential downstream IDOR weaknesses.