CVE-2025-64487 Outline is vulnerable to privilege escalation vulnerability in document sharing
Attackers can escalate privileges in Outline due to inconsistent authorization checks in document sharing endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-64487?
CVE-2025-64487 is a high-severity vulnerability in outline, published on 11 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership management endpoints. This vulnerability is fixed in 1.1.0.
Weakness: CWE-269
Which versions are affected by CVE-2025-64487?
It affects 1 product.
Products include Getoutline Outline.
How do I fix CVE-2025-64487?
No fix has been published for CVE-2025-64487 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64487 being exploited?
There is no known exploitation of CVE-2025-64487 in the wild and no public exploit code.
Other vulnerabilities in outline
- CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP
- CVE-2024-37829 Auth bypass in n/a
- CVE-2023-54331 Outline 1.6.0 - Unquoted Service Path
- CVE-2023-3532 Cross-site Scripting (XSS) - Stored in outline/outline
- CVE-2026-24901 Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts
Sources
Also known as GHSA-c8xf-3j86-7686.