CVE-2026-43889 Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share
Attackers can publish unauthorized documents by exploiting flawed permission checks in the sharing API, exposing private content to unauthenticated users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43889?
CVE-2026-43889 is a medium-severity missing authorization vulnerability in outline, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifies read access for each—skipping the "share" permission check. A subsequent shares.update authorizes publication using an OR policy (can share collection OR can share document), so an attacker who holds share permission on one unrelated collection can publish a share that exposes an arbitrary document they cannot legitimately share, making it publicly accessible to unauthenticated users. This vulnerability is fixed in 1.7.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-43889?
How do I fix CVE-2026-43889?
No fix has been published for CVE-2026-43889 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-43889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43889 exists.
Sources
Also known as GHSA-rg4j-pmch-w6pm.