CVE-2026-113611: Outline Auth Bypass Vulnerability

CVE-2026-113611 Overview

Outline versions before 1.8.0 contain an improper access revocation vulnerability [CWE-863] in the UserDeletedProcessor component. When an administrator account is deleted, the processor fails to disable the user's WebhookSubscription rows. Former administrators who registered webhooks before deletion continue to receive full document bodies, including Markdown and Yjs collaborative data, through DeliverWebhookTask for every matching workspace event.

This flaw turns account deletion into an incomplete access revocation. Attackers who held administrator privileges retain a persistent exfiltration channel after their removal from the workspace.

Critical Impact
Deleted administrators continue receiving confidential document contents via orphaned webhook subscriptions, enabling long-term data exfiltration after account termination.

Affected Products

Outline (knowledge base and wiki software) versions prior to 1.8.0
Self-hosted and managed Outline deployments running vulnerable versions
Workspaces that permitted administrators to register webhook subscriptions before deletion

Discovery Timeline

2026-10-20 - CVE-2026-113611 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-113611

Vulnerability Analysis

Outline uses a queue processor named UserDeletedProcessor to clean up resources associated with removed users. The processor handles related entities such as Subscription, UserAuthentication, and UserMembership, but it omits WebhookSubscription. Because webhook rows remain active, the delivery pipeline continues to resolve them when workspace events fire.

Each matching event triggers DeliverWebhookTask, which posts the full event payload to the registered URL. Payloads include document contents in both Markdown form and the raw Yjs CRDT state used for collaborative editing. A deleted administrator who controls the webhook endpoint receives a continuous stream of workspace data.

The issue is a broken access control condition rather than a code execution flaw. Exploitation requires that the attacker previously held administrator privileges with webhook creation rights, which is reflected in the high privileges required (PR:H) attack metric.

Root Cause

The root cause is a missing cleanup step inside server/queues/processors/UserDeletedProcessor.ts. The processor does not import or operate on the WebhookSubscription model, so webhooks created by the deleted user remain enabled and continue to match event filters indefinitely.

Attack Vector

An administrator registers one or more webhook subscriptions targeting an attacker-controlled endpoint. The administrator account is later deleted by another operator. Because UserDeletedProcessor leaves the webhook rows active, document create, update, and publish events continue to deliver full content to the external endpoint until an operator manually removes the orphaned rows.

typescript

// Patch excerpt: server/queues/processors/UserDeletedProcessor.ts
   Subscription,
   UserAuthentication,
   UserMembership,
+  WebhookSubscription,
 } from "@server/models";
 import { sequelize } from "@server/storage/database";
 import type { Event as TEvent, UserEvent } from "@server/types";
// Source: https://github.com/outline/outline/commit/e044014cea958962fc9f5e2b8f6ff1d8cadd676f

The patch imports WebhookSubscription into the processor so that associated webhooks are disabled during user deletion. A companion UI change in app/components/UserDialogs.tsx warns operators that API keys, webhooks, and integrations created by the user will stop working after deletion.

Detection Methods for CVE-2026-113611

Indicators of Compromise

Active WebhookSubscription rows whose createdById references a user record that no longer exists or is marked deleted.
Outbound HTTPS requests from Outline worker processes to endpoints not approved by the workspace owner.
DeliverWebhookTask log entries delivering document events to URLs registered by former administrators.

Detection Strategies

Query the webhook_subscriptions table and join against the users table to surface subscriptions whose owners are deleted or suspended.
Review webhook delivery logs for sustained traffic to third-party domains following administrator offboarding events.
Correlate HR or IAM deprovisioning records with Outline audit logs to confirm that webhooks owned by removed users are disabled.

Monitoring Recommendations

Alert on any webhook delivery whose associated user account state is not active.
Track egress destinations from Outline application servers and flag new or unapproved webhook URLs.
Baseline the volume of DeliverWebhookTask executions per user and investigate deliveries attributed to inactive owners.

How to Mitigate CVE-2026-113611

Immediate Actions Required

Upgrade Outline to version 1.8.0 or later, which includes the fix in commit e044014c.
Audit the webhook_subscriptions table and disable any rows owned by deleted, suspended, or former administrator accounts.
Rotate any secrets or tokens that may have been exposed through orphaned webhook deliveries since affected users were removed.

Patch Information

The fix is included in the GitHub Release v1.8.0 and documented in GitHub Security Advisory GHSA-33jq-x32c-3ccw. Technical background is available in the VulnCheck Advisory for Outline and the GitHub Commit e044014c.

Workarounds

Manually disable webhook subscriptions owned by any user before deleting that user account.
Restrict webhook creation to a small set of trusted service accounts rather than individual administrators.
Implement an offboarding checklist that explicitly revokes API keys, webhooks, and integrations prior to account deletion.

bash

# Example: identify orphaned webhook subscriptions in PostgreSQL
psql -d outline -c "SELECT ws.id, ws.url, ws.\"createdById\", u.\"deletedAt\" \
  FROM webhook_subscriptions ws \
  LEFT JOIN users u ON u.id = ws.\"createdById\" \
  WHERE u.id IS NULL OR u.\"deletedAt\" IS NOT NULL;"