CVE-2025-64487: 
NixOS vulnerability analysis and mitigation

CVE-2025-64487 is a privilege escalation vulnerability in the Outline collaborative document management system, caused by inconsistent authorization checks between user and group membership management endpoints. It affects all Outline versions up to and including v1.0.1, and was fixed in version 1.1.0. The advisory was published on November 16, 2025, by the Outline maintainer (tommoor), with CVE assignment occurring in February 2026. The vulnerability carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory).

The root cause is classified as CWE-269 (Improper Privilege Management), with the authorization logic inconsistently enforced across different API endpoints responsible for managing user memberships versus group memberships. An authenticated low-privileged user can exploit this discrepancy to manipulate group or document membership in ways that should require elevated permissions, effectively escalating their access within the system. Exploitation requires network access, low privileges, and some degree of user interaction, with the scope of impact extending beyond the originating component (GitHub Advisory).

Successful exploitation allows an authenticated attacker to escalate their privileges within an Outline instance, gaining unauthorized access to documents and collections that should be restricted. The primary impact is high confidentiality loss — an attacker could read sensitive shared documents across the organization — with a low integrity impact from unauthorized membership manipulation. Availability is not directly affected, but the exposure of confidential documentation could have significant downstream consequences for organizations using Outline for internal knowledge management (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication. The EPSS score is extremely low at 0.0001, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

The vulnerability is fixed in Outline version 1.1.0, released on November 16, 2025. All organizations running Outline v1.0.1 or earlier should upgrade to v1.1.0 or later immediately. As an interim measure, administrators should review access logs for anomalous membership management activity on user and group endpoints, and restrict access to membership management functionality to trusted administrators only until patching is complete (GitHub Advisory, Outline v1.1.0 Release).

The vulnerability was reported by security researcher 'p-' and disclosed responsibly through GitHub's security advisory process by Outline maintainer Tom Moor (tommoor). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified.