Is Outline 1.6.1 affected?

CVSS 8.7

9 known vulnerabilities affect 1.6.1 (highest CVSS 8.7).

10 newer releases in its track, up to 1.11.0. What changed up to 1.11.0

Vulnerabilities affecting 1.6.1

8.7
CVE-2026-43888 Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import fixed in 1.7.0
7.7
CVE-2026-41649 IDOR in document share creation allows unauthorized access to private documents across workspaces fixed in 1.7.0
6.5
CVE-2026-43889 Unauthorized Document Publication via Mixed collectionId+documentId Share fixed in 1.7.0
5.8
CVE-2026-44695 Slack OAuth state can link a victim Outline account to an attacker Slack identity fixed in 1.7.1
4.9
GHSA-33jq-x32c-3ccw Webhook subscription persists after creator's account deletion
4.3
GHSA-x92r-w4r2-vwmf Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info fixed in 1.9.0
4.3
GHSA-hqmp-r5jw-265r Attachment Preset Size-Limit Bypass and Storage Accounting Corruption in Local-Storage Mode fixed in 1.7.0
4.3
GHSA-rg3q-3m93-rq7m Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service fixed in 1.7.0
high
CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy