Tommoor

**Name of the Vulnerable Software and Affected Versions** Outline versions prior to 1.8.0 **Description** An authorization bypass exists due to a path parsing discrepancy. The `AuthenticationHelper.canAccess()` function uses `ctx.originalUrl` to verify if an API key or OAuth token possesses the necessary scopes for a request by extracting the last segment of the URL. However, the function does not strip the URL fragment (#). Since the Koa router utilizes `ctx.path` (which removes the fragment) for routing, an attacker can append a fragment containing a permitted path to a restricted endpoint. This causes the router to direct the request to the restricted endpoint while the `canAccess()` function validates the permitted path within the fragment, leading to privilege escalation. **Recommendations** Update to version 1.8.0.

**Name of the Vulnerable Software and Affected Versions** Outline versions 0.72.0 through 0.83.0 **Description** Outline, a collaborative documentation service, introduced a local file system storage feature in versions 0.72.0 through 0.83.0. This feature introduced a Content-Type bypass and a Cross-Site Scripting (CSP) bypass. When self-hosted and using `FILE STORAGE=local` on the same domain as the Outline application, a malicious payload could be uploaded as a file attachment, bypassing CSP restrictions and enabling script execution within another user’s context. **Recommendations** Update to version 0.84.0 or later.