CVE-2026-43886

Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access

Published May 11, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.

Analysis

Technical impact

A logic error in Outline's OAuthInterface.validateScope() allows a single valid scope to authorize the entire requested scope set, enabling an attacker to inject the wildcard * scope and upgrade a read‑only token to full unrestricted API access, including write, delete, and admin operations.

Affected Systems

Outline documentation platform, versions 0.84.0 through 1.6.1, inclusive. All releases prior to 1.7.0 are affected; version 1.7.0 and later contain the fix.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity vulnerability. Exploitation requires the ability to request OAuth scopes, which an attacker can achieve by manipulating the scope parameter in the authentication request. This flaw directly violates proper scope validation (CWE‑269) and results in privilege escalation. The EPSS score is not available; the vulnerability is not listed in CISA KEV, but its impact and accessible attack vector warrant immediate remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

outline

affected

Version	Status	Constraints
`>= 0.84.0, < 1.7.0`	affected	—

No data.

Vendor Product Versions

Getoutline

Outline

Version	Status	Scheme	Platform
`[0.84.0,1.7.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Outline release 1.7.0 or later to fully resolve the scope validation bug
If an immediate upgrade is not possible, restrict OAuth tokens to non‑wildcard scopes and enforce tighter scope validation logic in the deployment environment
Monitor OAuth token requests for unexpected scope values and audit authorization logs for privilege escalation attempts

Generated by OpenCVE AI on May 11, 2026 at 23:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/outline/outline/security/advisories/GHSA-7732-6qrg-wjf4

History

May 12, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 12, 2026 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Getoutline Getoutline outline
Vendors & Products		Getoutline Getoutline outline

May 11, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.
Title		Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access
Weaknesses		CWE-269
References		https://github.com/outline/outline/security/advisories/GHSA-7732-6qrg-wjf4
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N'}`