Outline allows collaborative documents to be shared via an API that, before version 1.7.0, accepts both a collection and a document identifier in the same request. When the created share is set to unpublished, the system only checks that the requester can read the collection and the document, but it does not enforce that the requester actually has share permission on either. Later, updating the share to publish uses an OR policy—requires share permission on either the collection or the document—to decide whether publication is allowed. An attacker who can share a different collection can therefore create a published share that exposes any document they can read but cannot normally share, making that document publicly available to anyone.

The Outline collaboration platform is affected, specifically any installation using a version older than 1.7.0. The vulnerable behavior is limited to the shares.create and shares.update API endpoints.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is unavailable so the current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a legitimate authenticated attacker who has share permissions on an unrelated collection; by invoking the create and update share APIs they can anonymously publish content they should not be able to expose.