CVE-2026-24901 - Vulnerability Analysis

Overview

Outline < 1.4.0 contains an insecure direct object reference caused by bypassing ownership validation in document restoration logic, letting team members restore, view, and seize ownership of deleted drafts of others, exploit requires team membership.

Severity & Score

Impact

Attackers can access sensitive private drafts and lock original owners out, compromising confidentiality and ownership control.

Mitigation

Update to version 1.4.0 or later.

References

• https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner