CVE-2026-113611

Awaiting Analysis Awaiting Analysis - Queue

Outline Improper Access Revocation in Outline Before 1.8.0

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113611

EUVD

EUVD-2026-105089

Affected Vendors & Products

Vendor	Product	Version / Range
outline	outline	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Outline before version 1.8.0 allows deleted administrators to continue receiving document contents via orphaned webhook subscriptions. When an admin account is deleted, the UserDeletedProcessor fails to disable their existing webhook subscriptions, enabling these subscriptions to keep sending full document data (including Markdown and Yjs content) to configured endpoints for every workspace event.

Detection Guidance

To detect this vulnerability, check for active webhook subscriptions linked to deleted admin accounts. Review database tables like WebhookSubscription for orphaned rows where the creator user no longer exists. Look for enabled subscriptions with no associated user in User table.

Impact Analysis

If you were an admin who created webhooks and your account was later deleted, sensitive document data could be continuously sent to unauthorized recipients. This exposes confidential information like document contents, collaboration data, and metadata to unintended parties without your knowledge.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive information. GDPR mandates strict access controls and data deletion upon request, while HIPAA requires safeguards to prevent unauthorized disclosure of protected health information. The flaw undermines compliance by allowing continued exposure of sensitive data.

Mitigation Strategies

Upgrade Outline to version 1.8.0 or later to apply the patch. Manually disable or delete any webhook subscriptions created by deleted admin accounts. Verify no orphaned subscriptions remain active in the database.

Hi! I’m here to help you understand CVE-2026-113611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...