CVE-2026-28506: Outline Information Disclosure Flaw

CVE-2026-28506 Overview

CVE-2026-28506 is an information disclosure vulnerability affecting Outline, a collaborative documentation service. The flaw exists in the events.list API endpoint, which is used for retrieving activity logs. Due to a logic flaw in its filtering mechanism, any authenticated user can retrieve activity events associated with documents that have no collection (such as Private Drafts and Deleted Documents), regardless of the user's actual permissions on those documents.

Critical Impact

While document content is not directly exposed, sensitive metadata including Document IDs, user activity timestamps, and document titles (in cases like Permanent Delete operations) can be leaked. This enables attackers to perform IDOR attacks against other endpoints like documents.restore by eliminating UUID randomness protection.

Affected Products

• getoutline outline (versions prior to 1.5.0)

Discovery Timeline

• 2026-03-17 - CVE CVE-2026-28506 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-28506

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue resides in the events.list API endpoint's authorization logic, which fails to properly validate whether the requesting user has legitimate access to documents associated with the returned activity events.

The filtering mechanism incorrectly handles documents that exist outside of collections—specifically Private Drafts and Deleted Documents. When a user queries the activity log endpoint, the system returns events for these orphaned documents without verifying that the requesting user owns or has permission to access them.

The attack requires network access and low-privilege authentication (any valid user account). The vulnerability enables horizontal information disclosure, allowing users to access metadata belonging to other users' private or deleted content.

Root Cause

The root cause is a business logic flaw in the event filtering system. The events.list endpoint applies permission checks based on collection membership, but documents without a collection (Private Drafts, Deleted Documents) bypass these checks entirely. This creates an authorization gap where the system assumes that documents outside collections don't require permission validation.

Attack Vector

An authenticated attacker can exploit this vulnerability through the following approach:

1. The attacker authenticates to the Outline instance using any valid user credentials
2. The attacker makes requests to the events.list API endpoint
3. Due to the flawed filtering logic, the endpoint returns activity events for documents without collections
4. The attacker extracts Document IDs, timestamps, user activity patterns, and potentially document titles from permanent delete operations
5. Using the leaked Document IDs, the attacker can attempt IDOR attacks on other endpoints such as documents.restore, since UUID randomness no longer protects these resources

The vulnerability significantly reduces the attack complexity for secondary IDOR exploits by exposing valid Document IDs that would otherwise be protected by UUID unpredictability. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-28506

Indicators of Compromise

• Unusual volume of requests to the events.list API endpoint from a single authenticated user
• Access patterns showing a user retrieving events for documents they don't own or have explicit access to
• Sequential or scripted enumeration requests targeting the activity log endpoint

Detection Strategies

• Monitor API access logs for the events.list endpoint and flag requests returning events for documents outside the requesting user's permission scope
• Implement anomaly detection for authenticated users accessing activity logs at rates inconsistent with normal usage patterns
• Review audit logs for correlation between events.list queries and subsequent attempts to access documents.restore or similar endpoints

Monitoring Recommendations

• Enable detailed logging for the events.list endpoint including request parameters and response metadata counts
• Configure alerts for authentication sessions that query activity logs and subsequently attempt document restoration operations
• Establish baseline metrics for activity log API usage to identify statistical anomalies

How to Mitigate CVE-2026-28506

Immediate Actions Required

• Upgrade Outline to version 1.5.0 or later immediately
• Review audit logs for potential exploitation attempts against the events.list endpoint
• Assess whether sensitive document metadata may have been exposed and notify affected users if warranted

Patch Information

Version 1.5.0 of Outline addresses this vulnerability by implementing proper permission validation for the events.list endpoint. The fix ensures that activity events for documents without collections (Private Drafts, Deleted Documents) are only returned to users with legitimate ownership or access permissions.

For detailed patch information, refer to the GitHub Security Advisory GHSA-69x7-6fcr-mm6g.

Workarounds

• Restrict access to the events.list API endpoint at the network or reverse proxy level to administrative users only until patching is complete
• Implement additional authentication requirements or rate limiting on the activity log endpoint
• Consider temporarily disabling the activity log feature if it is not essential for operations

# Example: Restrict events.list endpoint access via nginx until patch is applied
location /api/events.list {
    # Allow only administrative IP ranges
    allow 10.0.0.0/8;
    deny all;
}