https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 01:28:39 +0000 https://db.gcve.eu/vuln/cve-2026-120489 <p><strong>Affected:</strong> Outline</p> <p>Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.</p> <p><strong>Affected:</strong> Outline</p> <p>Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.</p> https://db.gcve.eu/vuln/cve-2026-120489