CVE-2026-120489 — Vulnerability intelligence
—
Published:
- CVSS
- 5.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.