CVE-2026-44695
Outline Slack Integration OAuth State Validation Bypass
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| outline | outline | 1.7.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Outline service before version 1.7.1, specifically its Slack integration callback for the GET /auth/slack.post endpoint. The issue is that the OAuth state value used in the callback is unsigned and session-independent. This means that a third party who obtains a Slack OAuth code for the same Outline Slack client can trick a logged-in Outline user into completing the callback. As a result, the attacker can link the victim's Outline account to the attacker's Slack team_id and user_id.
Once linked, the attacker can use the Slack /outline search command as if they were the victim Outline user, effectively impersonating them within the Slack integration.
This vulnerability was fixed in Outline version 1.7.1.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and impersonation within the Outline service via its Slack integration. An attacker who exploits this flaw can link their Slack identity to a victim's Outline account and perform actions on behalf of the victim using the Slack /outline search command.
The impact includes potential exposure of sensitive documentation or information accessible through Outline, as the attacker can search and interact with the victim's Outline data through Slack.
The CVSS base score of 5.8 indicates a moderate severity, with high confidentiality impact but no impact on integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the Outline service to version 1.7.1 or later, where the issue has been fixed.