CVE-2026-24901 Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts

What is CVE-2026-24901?

CVE-2026-24901 is a high-severity missing authorization vulnerability in outline, published on 17 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue.

Weakness: CWE-639

Which versions are affected by CVE-2026-24901?

It affects 1 product.

Products include Getoutline Outline.

How do I fix CVE-2026-24901?

No fix has been published for CVE-2026-24901 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24901 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24901 exists.

Other vulnerabilities in outline

• CVE-2026-33640 Outline has a rate limit bypass that allows brute force of email login OTP Critical 9.1
• CVE-2024-37829 Auth bypass in n/a High 8.8
• CVE-2023-54331 Outline 1.6.0 - Unquoted Service Path High 8.5
• CVE-2023-3532 Cross-site Scripting (XSS) - Stored in outline/outline High 8.5
• CVE-2026-41649 Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gmr5-43f5-79f5.