Outline

Collaboration · products/outline.yaml · RSS

Latest 1.11.0 Oct 12, 2026

Recent releases

1.11.0 Oct 12, 2026 Release notes ↗ 40feature

1.10.1 Sep 9, 2026 → 1.11.0 Release notes ↗ 6feature34fix

1.10.0 Sep 2, 2026 → 1.11.0 Release notes ↗ 40feature

1.9.2 Jul 21, 2026 → 1.11.0 Release notes ↗ 1feature16fix

1.9.1 Jul 13, 2026 → 1.11.0 Release notes ↗ 6feature8fix

1.9.0 Jul 9, 2026 → 1.11.0 Release notes ↗ 1security16feature24fix

securityFixes GHSA-x92r-w4r2-vwmf: Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info

1.8.1 Jun 6, 2026 → 1.11.0 Release notes ↗ 4feature17fix

1.8.0 Jun 1, 2026 → 1.11.0 Release notes ↗ 22feature17fix1breaking

breakingRemoved an N+1 query in documents.search – https://github.com/outline/outline/pull/12540

1.7.1 May 4, 2026 → 1.11.0 Release notes ↗ 1security10feature11fix

securityFixes CVE-2026-44695: Slack OAuth state can link a victim Outline account to an attacker Slack identity

1.7.0 Apr 24, 2026 → 1.11.0 Release notes ↗ 5security34feature6fix

securityFixes CVE-2026-43888: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import

securityFixes CVE-2026-41649: IDOR in document share creation allows unauthorized access to private documents across workspaces

securityFixes CVE-2026-43889: Unauthorized Document Publication via Mixed collectionId+documentId Share

1.6.1 Mar 18, 2026 → 1.11.0 Release notes ↗ 11fix

1.6.0 Mar 15, 2026 → 1.11.0 Release notes ↗ 25feature15fix

1.5.0 Feb 15, 2026 → 1.11.0 Release notes ↗ 1security16feature24fix

securityFixes CVE-2026-28506: Information Disclosure in Activity Logs allows User Enumeration of Private Drafts

1.4.0 Jan 27, 2026 → 1.11.0 Release notes ↗ 2security8feature21fix

securityFixes CVE-2026-24901: IDOR allows unauthorized viewing and seizing of private deleted drafts

securityFixes CVE-2026-25062: Arbitrary File Read via Path Traversal in JSON Import

1.3.0 Jan 17, 2026 → 1.11.0 Release notes ↗ 14feature22fix

Security advisories

4.3 GHSA-x92r-w4r2-vwmf Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info

6.5 GHSA-c43v-wwv4-9mcc Viewer users can publish documents into restricted collections through Outline MCP workflow

high CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

4.9 GHSA-33jq-x32c-3ccw Webhook subscription persists after creator's account deletion

4.3 GHSA-pp65-6cc2-4mx9 MCP `list_documents` tool exact-match lookup leaks unauthorized document metadata

3.7 GHSA-wgqc-257g-78v3 Timing-Unsafe Token Comparison in Unauthenticated Unsubscribe Endpoints

5.8 CVE-2026-44695 Slack OAuth state can link a victim Outline account to an attacker Slack identity

medium CVE-2026-43890 IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)

8.2 CVE-2026-43886 OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access

8.7 CVE-2026-43888 Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import

6.5 CVE-2026-43889 Unauthorized Document Publication via Mixed collectionId+documentId Share

7.3 CVE-2026-43887 Stored XSS via Comment Mentions

4.3 GHSA-hqmp-r5jw-265r Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode

4.3 GHSA-rg3q-3m93-rq7m Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service

7.7 CVE-2026-41649 IDOR in document share creation allows unauthorized access to private documents across workspaces

9.1 CVE-2026-33640 Rate limit bypass allows brute force of email login OTP

8.1 CVE-2026-24901 IDOR allows unauthorized viewing and seizing of private deleted drafts

4.3 CVE-2026-28506 Information Disclosure in Activity Logs allows User Enumeration of Private Drafts

5.5 CVE-2026-25062 Arbitrary File Read via Path Traversal in JSON Import

medium GHSA-h9mv-vg9r-8c7c Event Access Insecure Direct Object Reference (IDOR)

Recent releases

Security advisories

Sources