Outline’s subscriptions.create endpoint suffers a classic IDOR whereby a user can request a subscription to a private document they cannot read. When both collectionId and documentId are supplied, the handler mistakenly authorizes only the collection level, while the downstream command records the subscription directly against the supplied document ID. This allows an attacker to create a subscription to any private document, potentially gaining notification access, co‑listing, and other metadata exposures. The vulnerability is a textbook example of CWE‑639: Authorization Bypass via Privilege Escalation.

Outline Outline, versions 0.84.0 through 1.7.0 inclusive. Any instance that exposes the subscriptions.create API during that version range is affected. The issue was resolved in version 1.7.1.

The CVSS score of 7.7 flags this as a high‑severity flaw. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited public exploitation. An attacker must be authenticated and craft an HTTP POST request to the subscriptions.create endpoint, providing both a collectionId and a documentId that triggers the broken authorization path. The attack requires no additional privileges beyond a legitimate user account and can be performed remotely via the API, making it relatively low effort but with non‑trivial impact in environments with many private documents.