{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-16T15:20:08.274","vulnerabilities":[{"cve":{"id":"CVE-2026-24901","sourceIdentifier":"security-advisories@github.com","published":"2026-03-17T16:16:20.350","lastModified":"2026-03-19T19:32:41.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can access sensitive private information and effectively lock the original owner out of their own content. Version 1.4.0 fixes the issue."},{"lang":"es","value":"Outline es un servicio que permite la documentación colaborativa. Antes de la 1.4.0, una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) en la lógica de restauración de documentos permite a cualquier miembro del equipo restaurar, ver y tomar posesión de forma no autorizada de borradores eliminados pertenecientes a otros usuarios, incluidos los administradores. Al eludir la validación de propiedad durante el proceso de restauración, un atacante puede acceder a información privada sensible y dejar al propietario original sin acceso a su propio contenido. La versión 1.4.0 soluciona el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.0","matchCriteriaId":"A1297792-2032-4407-B790-09BFBDF42500"}]}]}],"references":[{"url":"https://github.com/outline/outline/security/advisories/GHSA-gmr5-43f5-79f5","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]}]}}]}