CVE-2026-28506

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user's actual permissions on those documents. While the document content is not directly exposed, this vulnerability leaks sensitive metadata (such as Document IDs, user activity timestamps, and in some specific cases like the Document Title of Permanent Delete). Crucially, leaking valid Document IDs of deleted drafts removes the protection of UUID randomness, making High-severity IDOR attacks (such as the one identified in documents.restore) trivially exploitable by lowering the attack complexity. Version 1.5.0 fixes the issue.

• CWE-200

• https://github.com/outline/outline/security/advisories/GHSA-69x7-6fcr-mm6gExploit, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2850A vulnerability was found in yeqifu warehouse up to aaf29962…6.5
• CVE-2026-28500Open Neural Network Exchange (ONNX) is an open standard for …9.1
• CVE-2026-28501WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-28502WWBN AVideo is an open source video platform. Prior to versi…8.8
• CVE-2026-28503Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-28505Tautulli is a Python based monitoring and tracking tool for …10
• CVE-2026-28507Idno is a social publishing platform. Prior to version 1.6.4…7.2
• CVE-2026-28508Idno is a social publishing platform. Prior to version 1.6.4…8.6
• CVE-2026-28509LangBot is a global IM bot platform designed for LLMs. Prior…5.4
• CVE-2026-2851A vulnerability was determined in yeqifu warehouse up to aaf…5.3
• CVE-2026-28510eLabFTW is an open source electronic lab notebook. In elabft…5.9
• CVE-2026-28511eLabFTW is an open source electronic lab notebook. Prior to …4.3