Outline allows collaborative documentation and offers a Slack integration. The vulnerability lies in the callback endpoint GET /auth/slack.post, which accepts a session‑independent OAuth state that is not signed or validated. An attacker who can obtain a Slack OAuth code for the same Outline Slack client can force a logged‑in Outline user to complete this callback, thereby linking that user's Outline account to the attacker's Slack team_id and user_id. Once linked, the attacker can use Slack commands, such as /outline search, to act as the victim Outline user and access or manipulate their documents.

All Outline deployments running a version earlier than 1.7.1 are affected. The vulnerability has been fixed in Outline 1.7.1 and later releases.

The CVSS score of 5.8 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to obtain a valid Slack OAuth code for the target Outline Slack client, which suggests limited but realistic risk in environments where the Slack integration is widely used. Because the state parameter is not validated, the exploit is likely straightforward for an attacker who can trigger the callback on a compromised or logged‑in user’s session.