CVE-2026-113611
MEDIUM
CVSS 4.9
Published: 2026-10-20
Modified: 2026-10-20
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
Quick Facts
| CVE ID | CVE-2026-113611 |
| CVSS Score | 4.9 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-10-20 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/outline/outline/blob/v1.7.1/server/queues…
- https://github.com/outline/outline/commit/e044014cea958962fc…
- https://github.com/outline/outline/releases/tag/v1.8.0
- https://github.com/outline/outline/security/advisories/GHSA-…
- https://www.vulncheck.com/advisories/outline-before-1.8.0-in…