Beveiligingsadvies

CVE-2026-43886

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-11 21:06:16

Laatst bijgewerkt 2026-05-12 13:20:35

Toegewezen door GitHub_M

CVSS-score 8.2

Status PUBLISHED

Beschrijving

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.

← Alle CVE's bekijken Bekijk op cve.org ↗