Threats tagged 'ghsa-4q4r-qmm8-wr2p'

Outline versions before 1.12.0 have an improper access control vulnerability that allows unauthenticated users to read unpublished documents. This occurs because the share loader does not respect the unpublished status of documents. Attackers with an existing share link can access withdrawn content via specific share-related routes, while attempts to revoke shares return a 404 error, preventing revocation.