CVE-2026-28506: 
NixOS vulnerability analysis and mitigation

CVE-2026-28506 is an information disclosure vulnerability in Outline, a collaborative documentation service, affecting all versions prior to 1.5.0. A logic flaw in the events.list API endpoint's filtering mechanism allows any authenticated user to retrieve activity events for documents with no collection (e.g., Private Drafts, Deleted Documents), regardless of their actual permissions. The vulnerability was published on March 17, 2026, and patched in version 1.5.0. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) resides in server/routes/api/events/events.ts. When a user queries the event list without specific filters, the system builds a Sequelize query returning events in the user's collections OR "global events" — defined as any event where collectionId is null. Because Private Drafts and Deleted Documents also have collectionId: null in Outline's data model, and there is no check for actorId or document ownership in the second condition, events generated by any user on their private or deleted documents are returned to all authenticated members. This leaks Document IDs, user activity timestamps, and in some cases (e.g., documents.permanent_delete events) the document title stored in the data field (GitHub Advisory).

Exploitation allows any authenticated member to enumerate Document IDs and metadata (titles, timestamps) for private drafts and deleted documents belonging to other users, including administrators. While document content is not directly exposed, leaking valid UUID Document IDs eliminates the statistical impracticality of guessing UUIDs, reducing the attack complexity of downstream IDOR attacks (such as unauthorized document restoration via documents.restore) from High to Low. This enables subordinates to track admin activity on private drafts and potentially take over deleted documents, posing a significant confidentiality and integrity risk within the platform (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a crafted HTTP GET request to the /api/events.list endpoint that returns another user's activity events. No in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.022% (0.000220), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authentication: Log in to the target Outline instance as any authenticated member (no elevated privileges required).
2. Send crafted API request: Issue a GET request to /api/events.list without specifying collection or actor filters, e.g.:

   GET /api/events.list HTTP/1.1
   Host: <outline-instance>
   Authorization: Bearer <member_token>

3. Parse the response: The API returns a JSON array of activity events, including events from other users' private drafts and deleted documents, exposing documentId, actorId, timestamps, and in some cases document titles.
4. Harvest Document IDs: Extract valid documentId values from events of type documents.permanent_delete or similar, which include the document title in the data field.
5. Chain with IDOR attack: Use the harvested documentId to call a privileged endpoint such as documents.restore, exploiting the now-trivially-guessable UUID to restore or access a document the attacker does not own (GitHub Advisory).

• Network: Unusual or repeated GET requests to /api/events.list from low-privilege user accounts, particularly without collection-specific filter parameters; requests originating from accounts that do not own the documents referenced in the returned events.
• Logs: API access logs showing authenticated member accounts querying events.list at high frequency or at unusual hours; log entries showing documents.restore calls referencing document IDs not previously accessed by the requesting user.
• Behavioral: A regular member account issuing documents.restore requests for documents belonging to admin or other users shortly after querying events.list — indicating chained IDOR exploitation (GitHub Advisory).

Upgrade Outline to version 1.5.0 or later, which fixes the filtering logic in the events.list endpoint to enforce proper permission checks. As a temporary workaround, administrators can restrict access to the events.list API endpoint or implement monitoring/alerting for unusual access patterns to activity logs involving documents without collections. Reviewing audit logs for suspicious events.list queries followed by documents.restore calls is also recommended (GitHub Advisory).

The vulnerability was reported by security researcher nlgbao1340 and published by Outline maintainer tommoor via GitHub Security Advisory on March 16–17, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).