CVE-2026-43886

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-43886

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43886.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-43886

Aliases

GHSA-7732-6qrg-wjf4

Published

2026-05-11T21:06:16.529Z

Modified

2026-08-07T11:31:07.525946665Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N CVSS Calculator

Summary

Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access

Details

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() uses Array.some() to validate requested OAuth scopes, causing the function to accept the entire scope array if any single scope is valid. An attacker can smuggle the wildcard * scope by requesting scope=read *, escalating a read-only OAuth token to full unrestricted API access including write, delete, and admin operations. This vulnerability is fixed in 1.7.0.

Database specific

{
    "cwe_ids": [
        "CWE-269"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43886.json"
}

References

Affected packages

Git / github.com/outline/outline

Affected ranges

Type

GIT

Repo

https://github.com/outline/outline

Events

Introduced

8ab0c6ff484f02b5d97e130b20376a17dd4546cc

Fixed

568b4ac074c67c5c58c75637c3a60b41f5bb1e6b

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.84.0"
        },
        {
            "fixed": "1.7.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43886.json"