Compliance Impact

This vulnerability allows an authenticated attacker to access documents from other workspaces without proper authorization, potentially exposing sensitive or confidential information.

Such unauthorized data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Outline service's `shares.create` API endpoint in versions from 0.86.0 up to but not including 1.7.0. When a request includes both `collectionId` and `documentId`, the authorization logic only verifies access to the collection and ignores the document itself. This flaw allows an authenticated attacker to create a valid public share link for any document on the platform, even those belonging to other workspaces. The attacker can then retrieve the full contents of these documents using the `documents.info` endpoint. The issue is fixed in version 1.7.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive documents across different workspaces within the Outline platform. An attacker with valid authentication can generate public share links to documents they should not have access to and retrieve their full contents. This could result in exposure of confidential or private information, potentially leading to data breaches or information leakage.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability exists in Outline versions starting from 0.86.0 up to but not including 1.7.0. The immediate step to mitigate this vulnerability is to upgrade Outline to version 1.7.0 or later, which contains a patch that fixes the insecure direct object reference issue.

Useful 0 Not Useful 0