CVE-2026-113611

MediumCVSS 4.9/10Last modified Oct 23, 2026

Description

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1136125.4SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food varia CVE-2026-1136138.1FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files CVE-2026-1136197.5In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are render CVE-2026-113629.8DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise in CVE-2026-1136209.8In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JW CVE-2026-113636.6The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up CVE-2026-113644.3The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data i CVE-2026-1136434.3A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/T CVE-2026-1136483.1ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1 CVE-2026-1136496.5ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheC CVE-2026-1136505.3ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTa CVE-2026-1136513.3ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attac