In Outline’s shares.create API, versions 0.86.0 to 1.6.x allow an authenticated user to pass both collectionId and documentId. The authorization check validates only the collection, ignoring the document, enabling the attacker to generate a legitimate public share link for any document, even those in other workspaces. The resulting link can be used to retrieve full document content via documents.info, effectively disclosing sensitive information.

The affected product is Outline, v0.86.0 through v1.6.x (inclusive). The fix was introduced in v1.7.0. Any deployment running a version in that range without the patch is susceptible.

The CVSS score of 7.7 indicates a high severity vulnerability, and the EPSS score is unavailable, so the current exploitation probability is unknown. The vulnerability is not listed in KEV, suggesting no widespread exploitation reported. Attackers need authenticated access to the Outline instance; once authenticated, they can invoke shares.create to create unauthorized share links. Because the abuse does not require elevated privileges beyond ordinary authenticated users, the risk surface is broad. Organizations should treat it as a moderate-to-high risk and act promptly.