Outline Service Vulnerability Elevates OAuth Tokens to Full API Access
The National Vulnerability Database has detailed CVE-2026-43886, a critical logic error in Outline, a collaborative documentation service. Versions 0.84.0 through 1.6.1 are affected. The vulnerability stems from a flaw in OAuthInterface.validateScope(), which incorrectly uses Array.some() to validate requested OAuth scopes. This allows the function to accept an entire scope array if even one scope is valid.
Attackers can exploit this by requesting a scope like scope=read *. This seemingly innocuous request is then misinterpreted, allowing the wildcard * scope to be smuggled through. The result is a severe privilege escalation: a read-only OAuth token is elevated to full, unrestricted API access, including the ability to perform write, delete, and administrative operations. This effectively hands over the keys to an Outline instance.
This is a significant flaw. It’s not just about data exposure; it’s about complete control. The National Vulnerability Database confirms that this vulnerability is fixed in Outline version 1.7.0. Defenders need to understand that this isn’t a complex chain of exploits; it’s a simple, direct bypass of authorization logic, leading to total compromise. The CVSS score of 8.2 (HIGH) is well-deserved given the impact.
What This Means For You
- If your organization uses Outline for documentation, you need to check your version immediately. Any instance running between 0.84.0 and 1.6.1 is critically vulnerable to full API compromise. Patch to version 1.7.0 without delay. Audit your OAuth logs for any suspicious scope requests, especially those containing wildcards or unusual combinations, to detect potential exploitation attempts.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-43886: Outline OAuth Scope Smuggling for API Access Escalation
title: CVE-2026-43886: Outline OAuth Scope Smuggling for API Access Escalation
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
This rule detects the specific exploit pattern for CVE-2026-43886, where an attacker attempts to smuggle a wildcard scope ('*') in the OAuth authorization request by using 'scope=read *'. This bypasses scope validation and escalates a read-only token to full API access, enabling unauthorized write, delete, and admin operations.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-43886/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'scope=read *'
cs-uri|contains:
- '/oauth/authorize'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-43886 | Privilege Escalation | Outline versions 0.84.0 to 1.6.1 |
| CVE-2026-43886 | Auth Bypass | Outline OAuthInterface.validateScope() logic error |
| CVE-2026-43886 | Auth Bypass | OAuth scope smuggling via 'scope=read *' |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 12, 2026 at 01:22 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-8345 — D-Link DIR-816 1.10CNB05_R1B011D88210 Command Injection
CVE-2026-8345 — A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such...
Vaultwarden CVE-2026-43914: Brute-Force Bypass via 2FA Email
CVE-2026-43914 — Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login...
Vaultwarden CVE-2026-43913: Unconfirmed Owners Can Purge Vaults
CVE-2026-43913 — Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault....