CVE-2026-24901: 
NixOS vulnerability analysis and mitigation

CVE-2026-24901 is an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic of Outline, an open-source collaborative documentation platform. It allows any authenticated team member to restore, view, and seize ownership of deleted drafts belonging to other users, including administrators, by bypassing ownership validation. All Outline versions prior to 1.4.0 are affected. The vulnerability was published on March 17, 2026, and patched in version 1.4.0. It carries a CVSS v3.1 base score of 8.8 (High) per Feedly/NVD, and 8.1 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the /api/documents.restore endpoint fails to enforce ownership checks when processing document restoration requests. Two distinct weaknesses compound the issue: first, any authenticated user who possesses a deleted draft's UUID can retrieve its full content via the API without being the original creator, as the system checks the document's "Trash" state but not the requester's ownership; second, the restore endpoint accepts an attacker-supplied collectionId, allowing the attacker to move the victim's draft into a collection they control, which incorrectly re-assigns document ownership to the attacker. A detailed proof-of-concept reproduction sequence, including specific HTTP requests to /api/documents.restore, is publicly documented in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation allows any authenticated team member to read the full content of private deleted drafts belonging to other users (including administrators), effectively achieving unauthorized information disclosure. Beyond passive reading, the attacker can permanently seize ownership of the hijacked document, publishing it under their own account while the original owner loses all access — constituting both an integrity violation and a localized denial of service against the original owner's content. The vulnerability does not directly enable remote code execution or lateral movement beyond the Outline workspace, but exposure of administrator drafts could reveal sensitive organizational information (GitHub Advisory).

A detailed proof-of-concept exploit with step-by-step HTTP request sequences is publicly available in the GitHub Security Advisory, and Feedly classifies it as a high-confidence, real exploit (GitHub Advisory). Exploitation requires only a low-privilege authenticated session (team membership) and knowledge of the target draft's UUID; the UUID can be obtained via a separate information disclosure vulnerability (GHSA-69x7-6fcr-mm6g). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating a currently low probability of widespread exploitation (Red Hat CVE).

1. Reconnaissance: Identify a target Outline instance running a version prior to 1.4.0. Obtain a valid team member account (low-privilege access is sufficient).
2. Obtain target draft UUID: Use the companion information disclosure vulnerability (GHSA-69x7-6fcr-mm6g) or other means to enumerate the UUID of a deleted draft belonging to the victim (e.g., an administrator).
3. Access draft content: Send an authenticated GET/POST API request using the attacker's session token and the victim's draft UUID to retrieve the full content of the deleted draft. The system checks the document's Trash state but does not verify the requester's ownership.
4. Create attacker-controlled collection: As the attacker, create a new collection within the Outline workspace to serve as the destination for the hijacked document.
5. Restore and hijack ownership: Send a POST request to /api/documents.restore with the victim's draft id and the attacker's collectionId as the payload. The endpoint re-activates the document and incorrectly assigns ownership to the attacker.
6. Publish or exfiltrate: The attacker now owns the document, can publish it, read all sensitive content, and the original owner (e.g., the administrator) is permanently locked out of their own draft (GitHub Advisory).

• Network/API Logs: Unexpected POST requests to /api/documents.restore from users who are not the original document owner, particularly where the collectionId in the payload belongs to the requesting user but the document id belongs to another user.
• Application Logs: API access to deleted (Trash) documents by users other than the original creator, especially repeated lookups of draft UUIDs not associated with the requesting account.
• Behavioral: A team member account suddenly appearing as the owner of documents previously owned by other users (especially administrators); original document owners reporting loss of access to their own drafts.
• Audit Trail: Restoration events in Outline's activity log where the restoring user differs from the document's original creator (GitHub Advisory).

The only recommended remediation is to upgrade Outline to version 1.4.0 or later, which introduces strict ownership validation in the document restoration logic — requiring that the requesting user is either the original document owner or holds explicit administrative permissions over the specific object. No configuration-based workaround is available for versions prior to 1.4.0. Organizations unable to upgrade immediately should consider restricting team membership to trusted users and monitoring API access logs for anomalous restore requests (GitHub Advisory).

The vulnerability was reported by security researcher nlgbao1340 and published by Outline maintainer tommoor via GitHub Security Advisory on March 16–17, 2026. Social media coverage was noted on Mastodon (via @thehackerwire) and Bluesky, with general awareness posts circulating shortly after disclosure. No major vendor statements beyond the official advisory or significant independent researcher commentary have been identified (GitHub Advisory).