A logic error in Outline's OAuthInterface.validateScope() allows a single valid scope to authorize the entire requested scope set, enabling an attacker to inject the wildcard * scope and upgrade a read‑only token to full unrestricted API access, including write, delete, and admin operations.

Outline documentation platform, versions 0.84.0 through 1.6.1, inclusive. All releases prior to 1.7.0 are affected; version 1.7.0 and later contain the fix.

The CVSS score of 8.2 indicates a high severity vulnerability. Exploitation requires the ability to request OAuth scopes, which an attacker can achieve by manipulating the scope parameter in the authentication request. This flaw directly violates proper scope validation (CWE‑269) and results in privilege escalation. The EPSS score is not available; the vulnerability is not listed in CISA KEV, but its impact and accessible attack vector warrant immediate remediation.