Threats affecting pkg:github/outline

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.9	EPSS 0.5%	CVE-2026-113611outline · Incorrect Authorization Medium6.9EPSS 0.5%2026-10-20CVE Database V5CVE-2026-113611 Outline versions prior to 1.8.0 have an authorization vulnerability where deleted administrators continue to receive full document contents via webhooks. This occurs because the system does not disable webhook subscriptions for deleted users, allowing former admins to access document data including Markdown and Yjs data for workspace events. EPSS 0.5%Vulnerability	CVE Database V5	2026-10-20
Medium	4.3	EPSS 0.3%	CVE-2024-37830Outline · Open Redirect Medium4.3EPSS 0.3%2024-07-09CVE Database V5CVE-2024-37830 An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie. EPSS 0.3%Vulnerability CWE-601	CVE Database V5	2024-07-09
High	8.8	EPSS 0.7%	CVE-2024-37829Outline · Session Fixation High8.8EPSS 0.7%2024-07-09CVE Database V5CVE-2024-37829 An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link. EPSS 0.7%Vulnerability CWE-384	CVE Database V5	2024-07-09

Page 1 of 1