A critical authorization bypass vulnerability in Outline enables authenticated attackers to exfiltrate private documentation across workspaces, necessitating an immediate update to version 1.7.0.

The vulnerability is an Insecure Direct Object Reference (CWE-639) located in the shares.create API endpoint. The system fails to validate document-level permissions when both collectionId and documentId are provided, allowing an authenticated user to bypass access controls.

The exploitation of this flaw leads to the unauthorized disclosure of sensitive organizational documentation. Given the CVSS score of 7.7, this represents a high-severity risk that could result in significant data breaches, loss of intellectual property, and potential regulatory non-compliance regarding internal data privacy.

Immediate Action: Upgrade the Outline service to version 1.7.0 or later to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for anomalous patterns, specifically looking for repeated calls to shares.create or documents.info originating from unauthorized user accounts.

Compensating Controls: Implement strict network access controls and ensure that the Outline instance is not exposed to the public internet unless necessary, as the flaw requires an authenticated session to trigger.

Public Exploit Available: Unknown

The risk posed by CVE-2026-41649 is significant due to the potential for large-scale document exfiltration. Organizations utilizing the Outline platform must prioritize the deployment of version 1.7.0 to remediate the authorization logic flaw. Failure to patch allows any authenticated user to potentially access sensitive information across the entire platform, regardless of their intended permission level.